xt_NOTRACK.c 1.5 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465
  1. /* This is a module which is used for setting up fake conntracks
  2. * on packets so that they are not seen by the conntrack/NAT code.
  3. */
  4. #include <linux/module.h>
  5. #include <linux/skbuff.h>
  6. #include <linux/netfilter/x_tables.h>
  7. #include <net/netfilter/nf_conntrack_compat.h>
  8. MODULE_LICENSE("GPL");
  9. MODULE_ALIAS("ipt_NOTRACK");
  10. static unsigned int
  11. target(struct sk_buff **pskb,
  12. const struct net_device *in,
  13. const struct net_device *out,
  14. unsigned int hooknum,
  15. const struct xt_target *target,
  16. const void *targinfo)
  17. {
  18. /* Previously seen (loopback)? Ignore. */
  19. if ((*pskb)->nfct != NULL)
  20. return XT_CONTINUE;
  21. /* Attach fake conntrack entry.
  22. If there is a real ct entry correspondig to this packet,
  23. it'll hang aroun till timing out. We don't deal with it
  24. for performance reasons. JK */
  25. nf_ct_untrack(*pskb);
  26. (*pskb)->nfctinfo = IP_CT_NEW;
  27. nf_conntrack_get((*pskb)->nfct);
  28. return XT_CONTINUE;
  29. }
  30. static struct xt_target xt_notrack_target[] = {
  31. {
  32. .name = "NOTRACK",
  33. .family = AF_INET,
  34. .target = target,
  35. .table = "raw",
  36. .me = THIS_MODULE,
  37. },
  38. {
  39. .name = "NOTRACK",
  40. .family = AF_INET6,
  41. .target = target,
  42. .table = "raw",
  43. .me = THIS_MODULE,
  44. },
  45. };
  46. static int __init xt_notrack_init(void)
  47. {
  48. return xt_register_targets(xt_notrack_target,
  49. ARRAY_SIZE(xt_notrack_target));
  50. }
  51. static void __exit xt_notrack_fini(void)
  52. {
  53. xt_unregister_targets(xt_notrack_target, ARRAY_SIZE(xt_notrack_target));
  54. }
  55. module_init(xt_notrack_init);
  56. module_exit(xt_notrack_fini);