[IPVS] fixed to call nf_reset() to reset netfilter related fields

Recommended by Harald Welte <laforge@netfilter.org>

Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/ipvs/ip_vs_xmit.c b/net/ipv4/ipvs/ip_vs_xmit.c
index 3a85f7a8d02a60325409f9010d9f61e2897c40ea..9a8f051208d11886e08aea38d9fcaae27366ca7c 100644 (file)
--- a/net/ipv4/ipvs/ip_vs_xmit.c
+++ b/net/ipv4/ipvs/ip_vs_xmit.c
@@ -127,6 +127,7 @@ ip_vs_dst_reset(struct ip_vs_dest *dest)
 
 #define IP_VS_XMIT(skb, rt)                            \
 do {                                                   \
+       nf_reset(skb);                                  \
        (skb)->nfcache |= NFC_IPVS_PROPERTY;            \
        NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, (skb), NULL,  \
                (rt)->u.dst.dev, dst_output);           \
@@ -201,9 +202,6 @@ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
        /* Another hack: avoid icmp_send in ip_fragment */
        skb->local_df = 1;
 
-#ifdef CONFIG_NETFILTER_DEBUG
-       skb->nf_debug = 0;
-#endif /* CONFIG_NETFILTER_DEBUG */
        IP_VS_XMIT(skb, rt);
 
        LeaveFunction(10);
@@ -280,9 +278,6 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
        /* Another hack: avoid icmp_send in ip_fragment */
        skb->local_df = 1;
 
-#ifdef CONFIG_NETFILTER_DEBUG
-       skb->nf_debug = 0;
-#endif /* CONFIG_NETFILTER_DEBUG */
        IP_VS_XMIT(skb, rt);
 
        LeaveFunction(10);
@@ -418,10 +413,6 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
        /* Another hack: avoid icmp_send in ip_fragment */
        skb->local_df = 1;
 
-#ifdef CONFIG_NETFILTER_DEBUG
-       skb->nf_debug = 0;
-#endif /* CONFIG_NETFILTER_DEBUG */
-
        IP_VS_XMIT(skb, rt);
 
        LeaveFunction(10);
@@ -480,9 +471,6 @@ ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
        /* Another hack: avoid icmp_send in ip_fragment */
        skb->local_df = 1;
 
-#ifdef CONFIG_NETFILTER_DEBUG
-       skb->nf_debug = 0;
-#endif /* CONFIG_NETFILTER_DEBUG */
        IP_VS_XMIT(skb, rt);
 
        LeaveFunction(10);
@@ -557,9 +545,6 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
        /* Another hack: avoid icmp_send in ip_fragment */
        skb->local_df = 1;
 
-#ifdef CONFIG_NETFILTER_DEBUG
-       skb->nf_debug = 0;
-#endif /* CONFIG_NETFILTER_DEBUG */
        IP_VS_XMIT(skb, rt);
 
        rc = NF_STOLEN;