net/netfilter/xt_NOTRACK.c

   1 /* This is a module which is used for setting up fake conntracks
   2  * on packets so that they are not seen by the conntrack/NAT code.
   3  */
   4 #include <linux/module.h>
   5 #include <linux/skbuff.h>
   6
   7 #include <linux/netfilter/x_tables.h>
   8 #include <net/netfilter/nf_conntrack.h>
   9
  10 MODULE_DESCRIPTION("Xtables: Disabling connection tracking for packets");
  11 MODULE_LICENSE("GPL");
  12 MODULE_ALIAS("ipt_NOTRACK");
  13 MODULE_ALIAS("ip6t_NOTRACK");
  14
  15 static unsigned int
  16 notrack_tg(struct sk_buff *skb, const struct net_device *in,
  17            const struct net_device *out, unsigned int hooknum,
  18            const struct xt_target *target, const void *targinfo)
  19 {
  20         /* Previously seen (loopback)? Ignore. */
  21         if (skb->nfct != NULL)
  22                 return XT_CONTINUE;
  23
  24         /* Attach fake conntrack entry.
  25            If there is a real ct entry correspondig to this packet,
  26            it'll hang aroun till timing out. We don't deal with it
  27            for performance reasons. JK */
  28         skb->nfct = &nf_conntrack_untracked.ct_general;
  29         skb->nfctinfo = IP_CT_NEW;
  30         nf_conntrack_get(skb->nfct);
  31
  32         return XT_CONTINUE;
  33 }
  34
  35 static struct xt_target notrack_tg_reg[] __read_mostly = {
  36         {
  37                 .name           = "NOTRACK",
  38                 .family         = AF_INET,
  39                 .target         = notrack_tg,
  40                 .table          = "raw",
  41                 .me             = THIS_MODULE,
  42         },
  43         {
  44                 .name           = "NOTRACK",
  45                 .family         = AF_INET6,
  46                 .target         = notrack_tg,
  47                 .table          = "raw",
  48                 .me             = THIS_MODULE,
  49         },
  50 };
  51
  52 static int __init notrack_tg_init(void)
  53 {
  54         return xt_register_targets(notrack_tg_reg, ARRAY_SIZE(notrack_tg_reg));
  55 }
  56
  57 static void __exit notrack_tg_exit(void)
  58 {
  59         xt_unregister_targets(notrack_tg_reg, ARRAY_SIZE(notrack_tg_reg));
  60 }
  61
  62 module_init(notrack_tg_init);
  63 module_exit(notrack_tg_exit);