Re: [PATCH NF_CONNTRACK 6/9]: Drop conntrack reference when packet leaves IPv6

[Patrick McHardy <kaber@trash.net>]

Yasuyuki KOZAKAI wrote:
> This patch is for IPv6 and same change as follows.

Why not simply drop the reference earlier in ip6_input_finish()
before the packet is delivered to raw sockets?

Regards
Patrick

> diff -Nur linux-2.6.12-rc4-nfct-5-drop-ref/net/ipv6/ip6_input.c linux-2.6.12-rc4-nfct-6-drop-ref6/net/ipv6/ip6_input.c
> --- linux-2.6.12-rc4-nfct-5-drop-ref/net/ipv6/ip6_input.c	2005-05-20 03:29:38.000000000 +0900
> +++ linux-2.6.12-rc4-nfct-6-drop-ref6/net/ipv6/ip6_input.c	2005-05-19 21:28:26.000000000 +0900
> @@ -176,6 +176,11 @@
>  		if (ipprot->flags & INET6_PROTO_FINAL) {
>  			struct ipv6hdr *hdr;	
>  
> +			/* Free reference early: we don't need it any more,
> +			   and it may hold ip_conntrack module loaded
> +			   indefinitely. */
> +			nf_reset(skb);
> +
>  			skb_postpull_rcsum(skb, skb->nh.raw,
>  					   skb->h.raw - skb->nh.raw);
>  			hdr = skb->nh.ipv6h;
> diff -Nur linux-2.6.12-rc4-nfct-5-drop-ref/net/ipv6/raw.c linux-2.6.12-rc4-nfct-6-drop-ref6/net/ipv6/raw.c
> --- linux-2.6.12-rc4-nfct-5-drop-ref/net/ipv6/raw.c	2005-05-20 03:29:46.000000000 +0900
> +++ linux-2.6.12-rc4-nfct-6-drop-ref6/net/ipv6/raw.c	2005-05-19 21:51:35.000000000 +0900
> @@ -167,8 +167,10 @@
>  			struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC);
>  
>  			/* Not releasing hash table! */
> -			if (clone)
> +			if (clone) {
> +				nf_reset(clone);
>  				rawv6_rcv(sk, clone);
> +			}
>  		}
>  		sk = __raw_v6_lookup(sk_next(sk), nexthdr, daddr, saddr);
>  	}