1 /* This is a module which is used for setting up fake conntracks
2 * on packets so that they are not seen by the conntrack/NAT code.
4 #include <linux/module.h>
5 #include <linux/skbuff.h>
7 #include <linux/netfilter/x_tables.h>
8 #include <net/netfilter/nf_conntrack.h>
10 MODULE_LICENSE("GPL");
11 MODULE_ALIAS("ipt_NOTRACK");
12 MODULE_ALIAS("ip6t_NOTRACK");
15 target(struct sk_buff
*skb
,
16 const struct net_device
*in
,
17 const struct net_device
*out
,
19 const struct xt_target
*target
,
22 /* Previously seen (loopback)? Ignore. */
23 if (skb
->nfct
!= NULL
)
26 /* Attach fake conntrack entry.
27 If there is a real ct entry correspondig to this packet,
28 it'll hang aroun till timing out. We don't deal with it
29 for performance reasons. JK */
30 skb
->nfct
= &nf_conntrack_untracked
.ct_general
;
31 skb
->nfctinfo
= IP_CT_NEW
;
32 nf_conntrack_get(skb
->nfct
);
37 static struct xt_target xt_notrack_target
[] __read_mostly
= {
54 static int __init
xt_notrack_init(void)
56 return xt_register_targets(xt_notrack_target
,
57 ARRAY_SIZE(xt_notrack_target
));
60 static void __exit
xt_notrack_fini(void)
62 xt_unregister_targets(xt_notrack_target
, ARRAY_SIZE(xt_notrack_target
));
65 module_init(xt_notrack_init
);
66 module_exit(xt_notrack_fini
);