1 /* This is a module which is used for setting up fake conntracks
2 * on packets so that they are not seen by the conntrack/NAT code.
4 #include <linux/module.h>
5 #include <linux/skbuff.h>
7 #include <linux/netfilter/x_tables.h>
8 #include <net/netfilter/nf_conntrack_compat.h>
10 MODULE_LICENSE("GPL");
11 MODULE_ALIAS("ipt_NOTRACK");
14 target(struct sk_buff **pskb,
15 const struct net_device *in,
16 const struct net_device *out,
21 /* Previously seen (loopback)? Ignore. */
22 if ((*pskb)->nfct != NULL)
25 /* Attach fake conntrack entry.
26 If there is a real ct entry correspondig to this packet,
27 it'll hang aroun till timing out. We don't deal with it
28 for performance reasons. JK */
30 (*pskb)->nfctinfo = IP_CT_NEW;
31 nf_conntrack_get((*pskb)->nfct);
37 checkentry(const char *tablename,
40 unsigned int targinfosize,
41 unsigned int hook_mask)
43 if (targinfosize != 0) {
44 printk(KERN_WARNING "NOTRACK: targinfosize %u != 0\n",
49 if (strcmp(tablename, "raw") != 0) {
50 printk(KERN_WARNING "NOTRACK: can only be called from \"raw\" table, not \"%s\"\n", tablename);
57 static struct xt_target notrack_reg = {
60 .checkentry = checkentry,
63 static struct xt_target notrack6_reg = {
66 .checkentry = checkentry,
70 static int __init init(void)
74 ret = xt_register_target(AF_INET, ¬rack_reg);
78 ret = xt_register_target(AF_INET6, ¬rack6_reg);
80 xt_unregister_target(AF_INET, ¬rack_reg);
85 static void __exit fini(void)
87 xt_unregister_target(AF_INET6, ¬rack6_reg);
88 xt_unregister_target(AF_INET, ¬rack_reg);