rpms/kernel/FC-3 linux-2.6.11-net-conntrack-leak.patch, NONE, 1.1 kernel-2.6.spec, 1.824, 1.825

[fedora-cvs-commits at redhat.com]

Author: davej

Update of /cvs/dist/rpms/kernel/FC-3
In directory cvs.devel.redhat.com:/tmp/cvs-serv20228

Modified Files:
	kernel-2.6.spec 
Added Files:
	linux-2.6.11-net-conntrack-leak.patch 
Log Message:
Fix conntrack leak with raw sockets


linux-2.6.11-net-conntrack-leak.patch:
 ip_output.c                         |    2 ++
 netfilter/ip_conntrack_standalone.c |    7 -------
 2 files changed, 2 insertions(+), 7 deletions(-)

--- NEW FILE linux-2.6.11-net-conntrack-leak.patch ---
diff -ru linux-orig/net/ipv4/ip_output.c linux-new/net/ipv4/ip_output.c
--- linux-orig/net/ipv4/ip_output.c	2005-03-25 14:48:13.543911760 -0500
+++ linux-new/net/ipv4/ip_output.c	2005-03-26 01:01:13.064616240 -0500
@@ -195,6 +195,8 @@
 	nf_debug_ip_finish_output2(skb);
 #endif /*CONFIG_NETFILTER_DEBUG*/
 
+	nf_reset(skb);
+
 	if (hh) {
 		int hh_alen;
 
diff -ru linux-orig/net/ipv4/netfilter/ip_conntrack_standalone.c linux-new/net/ipv4/netfilter/ip_conntrack_standalone.c
--- linux-orig/net/ipv4/netfilter/ip_conntrack_standalone.c	2005-03-25 14:48:13.550910696 -0500
+++ linux-new/net/ipv4/netfilter/ip_conntrack_standalone.c	2005-03-26 01:03:09.916852000 -0500
@@ -423,13 +423,6 @@
 				        const struct net_device *out,
 				        int (*okfn)(struct sk_buff *))
 {
-#if !defined(CONFIG_IP_NF_NAT) && !defined(CONFIG_IP_NF_NAT_MODULE)
-	/* Previously seen (loopback)?  Ignore.  Do this before
-           fragment check. */
-	if ((*pskb)->nfct)
-		return NF_ACCEPT;
-#endif
-
 	/* Gather fragments. */
 	if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
 		*pskb = ip_ct_gather_frags(*pskb,


Index: kernel-2.6.spec
===================================================================
RCS file: /cvs/dist/rpms/kernel/FC-3/kernel-2.6.spec,v
retrieving revision 1.824
retrieving revision 1.825
diff -u -r1.824 -r1.825
--- kernel-2.6.spec	10 May 2005 00:17:41 -0000	1.824
+++ kernel-2.6.spec	10 May 2005 00:19:44 -0000	1.825
@@ -281,6 +281,8 @@
 Patch1209: linux-2.6.9-lockd-block-nosleep.patch
 Patch1210: linux-2.6.9-lockd-reclaims.patch
 
+Patch1300: linux-2.6.11-net-conntrack-leak.patch
+
 # NIC driver updates
 Patch1351: linux-2.6.9-net-tr-irqlock-fix.patch
 Patch1362: linux-2.6.9-net-airo-nullptr.patch
@@ -563,6 +565,9 @@
 %patch1209 -p1
 %patch1210 -p1
 
+# Fix conntrack leak with raw sockets.
+%patch1300 -p1
+
 # NIC driver fixes.
 # Use correct spinlock functions in token ring net code
 %patch1351 -p1
@@ -918,6 +923,7 @@
   | Fixes CAN-2005-1369 (i2c alarms sysfs DoS). (#156683)
 - Merge IDE fixes from 2.6.11-ac7
 - Add Conflicts for older IPW firmwares.
+- Fix conntrack leak with raw sockets.
 
 * Sun May  1 2005 Dave Jones <davej at redhat.com>
 - Various firewire fixes backported from -mm. (#133798)