From 236d2f4990e34083f4d455c859a8aaf65b7e7e1e Mon Sep 17 00:00:00 2001 From: Jozsef Kadlecsik Date: Mon, 2 Feb 2004 18:26:40 -0800 Subject: [PATCH] [NETFILTER]: Fix NAT leak with fragmented packets, missing conntrack put in ip_copy_metadata(). --- net/ipv4/ip_output.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 04e792bd1c512..2adc6cc7994b4 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -414,6 +414,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from) to->nfmark = from->nfmark; to->nfcache = from->nfcache; /* Connection association is same as pre-frag packet */ + nf_conntrack_put(to->nfct); to->nfct = from->nfct; nf_conntrack_get(to->nfct); #ifdef CONFIG_BRIDGE_NETFILTER -- 2.53.0