diff options
| author | Gao feng <gaofeng@cn.fujitsu.com> | 2013-03-21 19:48:41 +0000 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-03-25 14:21:23 +0100 |
| commit | 130549fed828cc34c22624c6195afcf9e7ae56fe (patch) | |
| tree | 4d2f1ff9247a0708100d2c8b4fe15f96cc757ca5 | |
| parent | 7ebe183c6d444ef5587d803b64a1f4734b18c564 (diff) | |
| download | op-kernel-dev-130549fed828cc34c22624c6195afcf9e7ae56fe.zip op-kernel-dev-130549fed828cc34c22624c6195afcf9e7ae56fe.tar.gz | |
netfilter: reset nf_trace in nf_reset
We forgot to clear the nf_trace of sk_buff in nf_reset,
When we use veth device, this nf_trace information will
be leaked from one net namespace to another net namespace.
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | include/linux/skbuff.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 441f5bf..72b3967 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2641,6 +2641,9 @@ static inline void nf_reset(struct sk_buff *skb) nf_bridge_put(skb->nf_bridge); skb->nf_bridge = NULL; #endif +#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE) + skb->nf_trace = 0; +#endif } /* Note: This doesn't put any conntrack and bridge info in dst. */ |
