自学教程：C++ HOOK2MANIP函数代码示例

unsigned intalloc_null_binding(struct nf_conn *ct, unsigned int hooknum){	/* Force range to this IP; let proto decide mapping for	   per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).	   Use reply in case it's already been mangled (eg local packet).	*/	__be32 ip		= (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC		   ? ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip		   : ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);	struct nf_nat_range range		= { IP_NAT_RANGE_MAP_IPS, ip, ip, { 0 }, { 0 } };	pr_debug("Allocating NULL binding for %p (%pI4)/n", ct, &ip);	return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));}

unsigned intalloc_null_binding_confirmed(struct nf_conn *ct, unsigned int hooknum){	__be32 ip		= (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC		   ? ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip		   : ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);	u_int16_t all		= (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC		   ? ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.all		   : ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u.all);	struct nf_nat_range range		= { IP_NAT_RANGE_MAP_IPS, ip, ip, { all }, { all } };	pr_debug("Allocating NULL binding for confirmed %p (%pI4)/n",	       ct, &ip);	return nf_nat_setup_info(ct, &range, hooknum);}

static unsigned int nf_nat_fn(const struct nf_hook_ops *ops,			      struct sk_buff *skb,			      const struct net_device *in,			      const struct net_device *out,			      int (*okfn)(struct sk_buff *)){	enum ip_conntrack_info ctinfo;	struct nf_conn *ct = nf_ct_get(skb, &ctinfo);	struct nf_conn_nat *nat;	enum nf_nat_manip_type maniptype = HOOK2MANIP(ops->hooknum);	unsigned int ret;	if (ct == NULL || nf_ct_is_untracked(ct))		return NF_ACCEPT;	NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)));	nat = nfct_nat(ct);	if (nat == NULL) {		/* Conntrack module was loaded late, can't add extension. */		if (nf_ct_is_confirmed(ct))			return NF_ACCEPT;		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);		if (nat == NULL)			return NF_ACCEPT;	}	switch (ctinfo) {	case IP_CT_RELATED:	case IP_CT_RELATED + IP_CT_IS_REPLY:		if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {			if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,							   ops->hooknum))				return NF_DROP;			else				return NF_ACCEPT;		}		/* Fall through */	case IP_CT_NEW:		if (nf_nat_initialized(ct, maniptype))			break;		ret = nft_do_chain(ops, skb, in, out, okfn);		if (ret != NF_ACCEPT)			return ret;		if (!nf_nat_initialized(ct, maniptype)) {			ret = nf_nat_alloc_null_binding(ct, ops->hooknum);			if (ret != NF_ACCEPT)				return ret;		}	default:		break;	}	return nf_nat_packet(ct, ctinfo, ops->hooknum, skb);}

unsigned intalloc_null_binding_confirmed(struct ip_conntrack *conntrack,                             struct ip_nat_info *info,                             unsigned int hooknum){	u_int32_t ip		= (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC		   ? conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip		   : conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip);	u_int16_t all		= (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC		   ? conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.all		   : conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.src.u.all);	struct ip_nat_range range		= { IP_NAT_RANGE_MAP_IPS, ip, ip, { all }, { all } };	DEBUGP("Allocating NULL binding for confirmed %p (%u.%u.%u.%u)/n",	       conntrack, NIPQUAD(ip));	return ip_nat_setup_info(conntrack, &range, hooknum);}

static unsigned intmms_nat_expected(struct sk_buff **pskb,                 unsigned int hooknum,                 struct ip_conntrack *ct,                 struct ip_nat_info *info){	struct ip_nat_multi_range mr;	u_int32_t newdstip, newsrcip, newip;	struct ip_conntrack *master = master_ct(ct);	IP_NF_ASSERT(info);	IP_NF_ASSERT(master);	IP_NF_ASSERT(!(info->initialized & (1 << HOOK2MANIP(hooknum))));	DEBUGP("ip_nat_mms: mms_nat_expected: We have a connection!/n");	newdstip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;	newsrcip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;	DEBUGP("ip_nat_mms: mms_nat_expected: hook %s: newsrc->newdst %u.%u.%u.%u->%u.%u.%u.%u/n",	       hooknum == NF_IP_POST_ROUTING ? "POSTROUTING"	       : hooknum == NF_IP_PRE_ROUTING ? "PREROUTING"	       : hooknum == NF_IP_LOCAL_OUT ? "OUTPUT" : "???",	       NIPQUAD(newsrcip), NIPQUAD(newdstip));	if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC)		newip = newsrcip;	else		newip = newdstip;	DEBUGP("ip_nat_mms: mms_nat_expected: IP to %u.%u.%u.%u/n", NIPQUAD(newip));	mr.rangesize = 1;	/* We don't want to manip the per-protocol, just the IPs. */	mr.range[0].flags = IP_NAT_RANGE_MAP_IPS;	mr.range[0].min_ip = mr.range[0].max_ip = newip;	return ip_nat_setup_info(ct, &mr, hooknum);}

static unsigned int nf_nat_rule_find(struct sk_buff *skb, unsigned int hooknum,				     const struct net_device *in,				     const struct net_device *out,				     struct nf_conn *ct){	struct net *net = nf_ct_net(ct);	unsigned int ret;	ret = ipt_do_table(skb, hooknum, in, out, net->ipv4.nat_table);	if (ret == NF_ACCEPT) {		if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))			ret = alloc_null_binding(ct, hooknum);	}	return ret;}

int FASTPATHNET bcm_do_fastnat(struct nf_conn *ct,		enum ip_conntrack_info ctinfo,		struct sk_buff **pskb,		struct nf_conntrack_l3proto *l3proto,		struct nf_conntrack_l4proto *l4proto){	static int hn[2] = {NF_IP_PRE_ROUTING, NF_IP_POST_ROUTING};	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);	unsigned int i = 1;	do {		enum nf_nat_manip_type mtype = HOOK2MANIP(hn[i]);		unsigned long statusbit;		if (mtype == IP_NAT_MANIP_SRC)			statusbit = IPS_SRC_NAT;		else			statusbit = IPS_DST_NAT;		/* Invert if this is reply dir. */		if (dir == IP_CT_DIR_REPLY)			statusbit ^= IPS_NAT_MASK;		if (ct->status & statusbit) {			struct nf_conntrack_tuple target;			if ((*pskb)->dst == NULL && mtype == IP_NAT_MANIP_SRC) {				struct net_device *dev = (*pskb)->dev;				struct iphdr *iph = ip_hdr(*pskb);				if (ip_route_input((*pskb), iph->daddr, iph->saddr, iph->tos, dev))					return NF_DROP;				/* Change skb owner to output device */				(*pskb)->dev = (*pskb)->dst->dev;			}			/* We are aiming to look like inverse of other direction. */			nf_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple, l3proto, l4proto);			if (!manip_pkt(target.dst.protonum, pskb, 0, &target, mtype))				return NF_DROP;		}	} while (i++ < 2);	return NF_FAST_NAT;}

int nf_nat_rule_find(struct sk_buff *skb,		     unsigned int hooknum,		     const struct net_device *in,		     const struct net_device *out,		     struct nf_conn *ct){	int ret;	ret = ipt_do_table(skb, hooknum, in, out, &nat_table);	if (ret == NF_ACCEPT) {		if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))			/* NUL mapping */			ret = alloc_null_binding(ct, hooknum);	}	return ret;}

int ip_nat_rule_find(struct sk_buff **pskb,		     unsigned int hooknum,		     const struct net_device *in,		     const struct net_device *out,		     struct ip_conntrack *ct,		     struct ip_nat_info *info){	int ret;	ret = ipt_do_table(pskb, hooknum, in, out, &nat_table, NULL);	if (ret == NF_ACCEPT) {		if (!ip_nat_initialized(ct, HOOK2MANIP(hooknum)))			/* NUL mapping */			ret = alloc_null_binding(ct, info, hooknum);	}	return ret;}

inline unsigned intalloc_null_binding(struct ip_conntrack *conntrack,		   struct ip_nat_info *info,		   unsigned int hooknum){	/* Force range to this IP; let proto decide mapping for	   per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).	   Use reply in case it's already been mangled (eg local packet).	*/	u_int32_t ip		= (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC		   ? conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip		   : conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip);	struct ip_nat_range range		= { IP_NAT_RANGE_MAP_IPS, ip, ip, { 0 }, { 0 } };	DEBUGP("Allocating NULL binding for %p (%u.%u.%u.%u)/n", conntrack,	       NIPQUAD(ip));	return ip_nat_setup_info(conntrack, &range, hooknum);}

int nf_nat_icmp_reply_translation(struct sk_buff *skb,				  struct nf_conn *ct,				  enum ip_conntrack_info ctinfo,				  unsigned int hooknum){	struct {		struct icmphdr	icmp;		struct iphdr	ip;	} *inside;	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);	enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);	unsigned int hdrlen = ip_hdrlen(skb);	const struct nf_nat_l4proto *l4proto;	struct nf_conntrack_tuple target;	unsigned long statusbit;	WARN_ON(ctinfo != IP_CT_RELATED && ctinfo != IP_CT_RELATED_REPLY);	if (!skb_make_writable(skb, hdrlen + sizeof(*inside)))		return 0;	if (nf_ip_checksum(skb, hooknum, hdrlen, 0))		return 0;	inside = (void *)skb->data + hdrlen;	if (inside->icmp.type == ICMP_REDIRECT) {		if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)			return 0;		if (ct->status & IPS_NAT_MASK)			return 0;	}	if (manip == NF_NAT_MANIP_SRC)		statusbit = IPS_SRC_NAT;	else		statusbit = IPS_DST_NAT;	/* Invert if this is reply direction */	if (dir == IP_CT_DIR_REPLY)		statusbit ^= IPS_NAT_MASK;	if (!(ct->status & statusbit))		return 1;	l4proto = __nf_nat_l4proto_find(NFPROTO_IPV4, inside->ip.protocol);	if (!nf_nat_ipv4_manip_pkt(skb, hdrlen + sizeof(inside->icmp),				   l4proto, &ct->tuplehash[!dir].tuple, !manip))		return 0;	if (skb->ip_summed != CHECKSUM_PARTIAL) {		/* Reloading "inside" here since manip_pkt may reallocate */		inside = (void *)skb->data + hdrlen;		inside->icmp.checksum = 0;		inside->icmp.checksum =			csum_fold(skb_checksum(skb, hdrlen,					       skb->len - hdrlen, 0));	}	/* Change outer to look like the reply to an incoming packet */	nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);	l4proto = __nf_nat_l4proto_find(NFPROTO_IPV4, 0);	if (!nf_nat_ipv4_manip_pkt(skb, 0, l4proto, &target, manip))		return 0;	return 1;}

static unsigned intnf_nat_ipv6_fn(unsigned int hooknum,	       struct sk_buff *skb,	       const struct net_device *in,	       const struct net_device *out,	       int (*okfn)(struct sk_buff *)){	struct nf_conn *ct;	enum ip_conntrack_info ctinfo;	struct nf_conn_nat *nat;	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);	__be16 frag_off;	int hdrlen;	u8 nexthdr;	ct = nf_ct_get(skb, &ctinfo);	/* Can't track?  It's not due to stress, or conntrack would	 * have dropped it.  Hence it's the user's responsibilty to	 * packet filter it out, or implement conntrack/NAT for that	 * protocol. 8) --RR	 */	if (!ct)		return NF_ACCEPT;	/* Don't try to NAT if this packet is not conntracked */	if (nf_ct_is_untracked(ct))		return NF_ACCEPT;	nat = nfct_nat(ct);	if (!nat) {		/* NAT module was loaded late. */		if (nf_ct_is_confirmed(ct))			return NF_ACCEPT;		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);		if (nat == NULL) {			pr_debug("failed to add NAT extension/n");			return NF_ACCEPT;		}	}	switch (ctinfo) {	case IP_CT_RELATED:	case IP_CT_RELATED_REPLY:		nexthdr = ipv6_hdr(skb)->nexthdr;		hdrlen = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),					  &nexthdr, &frag_off);		if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {			if (!nf_nat_icmpv6_reply_translation(skb, ct, ctinfo,							     hooknum, hdrlen))				return NF_DROP;			else				return NF_ACCEPT;		}		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */	case IP_CT_NEW:		/* Seen it before?  This can happen for loopback, retrans,		 * or local packets.		 */		if (!nf_nat_initialized(ct, maniptype)) {			unsigned int ret;			ret = nf_nat_rule_find(skb, hooknum, in, out, ct);			if (ret != NF_ACCEPT)				return ret;		} else {			pr_debug("Already setup manip %s for ct %p/n",				 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",				 ct);			if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))				goto oif_changed;		}		break;	default:		/* ESTABLISHED */		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||			     ctinfo == IP_CT_ESTABLISHED_REPLY);		if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))			goto oif_changed;	}	return nf_nat_packet(ct, ctinfo, hooknum, skb);oif_changed:	nf_ct_kill_acct(ct, ctinfo, skb);	return NF_DROP;}

static unsigned intnf_nat_fn(unsigned int hooknum,	  struct sk_buff *skb,	  const struct net_device *in,	  const struct net_device *out,	  int (*okfn)(struct sk_buff *)){	struct nf_conn *ct;	enum ip_conntrack_info ctinfo;	struct nf_conn_nat *nat;	/* maniptype == SRC for postrouting. */	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);	/* We never see fragments: conntrack defrags on pre-routing	   and local-out, and nf_nat_out protects post-routing. */	NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)));	ct = nf_ct_get(skb, &ctinfo);	/* Can't track?  It's not due to stress, or conntrack would	   have dropped it.  Hence it's the user's responsibilty to	   packet filter it out, or implement conntrack/NAT for that	   protocol. 8) --RR */	if (!ct)		return NF_ACCEPT;	/* Don't try to NAT if this packet is not conntracked */	if (ct == &nf_conntrack_untracked)		return NF_ACCEPT;	nat = nfct_nat(ct);	if (!nat) {		/* NAT module was loaded late. */		if (nf_ct_is_confirmed(ct))			return NF_ACCEPT;		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);		if (nat == NULL) {			pr_debug("failed to add NAT extension/n");			return NF_ACCEPT;		}	}	switch (ctinfo) {	case IP_CT_RELATED:	case IP_CT_RELATED+IP_CT_IS_REPLY:		if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {			if (!nf_nat_icmp_reply_translation(ct, ctinfo,							   hooknum, skb))				return NF_DROP;			else				return NF_ACCEPT;		}		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */	case IP_CT_NEW:		/* Seen it before?  This can happen for loopback, retrans,		   or local packets.. */		if (!nf_nat_initialized(ct, maniptype)) {			unsigned int ret;			if (hooknum == NF_INET_LOCAL_IN)				/* LOCAL_IN hook doesn't have a chain!  */				ret = alloc_null_binding(ct, hooknum);			else				ret = nf_nat_rule_find(skb, hooknum, in, out,						       ct);			if (ret != NF_ACCEPT) {				return ret;			}		} else			pr_debug("Already setup manip %s for ct %p/n",				 maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",				 ct);		break;	default:		/* ESTABLISHED */		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||			     ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));	}	return nf_nat_packet(ct, ctinfo, hooknum, skb);}

unsigned intnf_nat_alloc_null_binding(struct nf_conn *ct, unsigned int hooknum){	return __nf_nat_alloc_null_binding(ct, HOOK2MANIP(hooknum));}

unsigned intnf_nat_setup_info(struct nf_conn *ct,		  const struct nf_nat_range *range,		  enum nf_nat_manip_type maniptype){	struct nf_conntrack_tuple curr_tuple, new_tuple;	/* Can't setup nat info for confirmed ct. */	if (nf_ct_is_confirmed(ct))		return NF_ACCEPT;	NF_CT_ASSERT(maniptype == NF_NAT_MANIP_SRC ||		     maniptype == NF_NAT_MANIP_DST);	BUG_ON(nf_nat_initialized(ct, maniptype));	/* What we've got will look like inverse of reply. Normally	 * this is what is in the conntrack, except for prior	 * manipulations (future optimization: if num_manips == 0,	 * orig_tp = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple)	 */	nf_ct_invert_tuplepr(&curr_tuple,			     &ct->tuplehash[IP_CT_DIR_REPLY].tuple);	get_unique_tuple(&new_tuple, &curr_tuple, range, ct, maniptype);	if (!nf_ct_tuple_equal(&new_tuple, &curr_tuple)) {		struct nf_conntrack_tuple reply;		/* Alter conntrack table so will recognize replies. */		nf_ct_invert_tuplepr(&reply, &new_tuple);		nf_conntrack_alter_reply(ct, &reply);		/* Non-atomic: we own this at the moment. */		if (maniptype == NF_NAT_MANIP_SRC)			ct->status |= IPS_SRC_NAT;		else			ct->status |= IPS_DST_NAT;		if (nfct_help(ct))			if (!nfct_seqadj_ext_add(ct))				return NF_DROP;	}	if (maniptype == NF_NAT_MANIP_SRC) {		struct nf_nat_conn_key key = {			.net = nf_ct_net(ct),			.tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,			.zone = nf_ct_zone(ct),		};		int err;		err = rhltable_insert_key(&nf_nat_bysource_table,					  &key,					  &ct->nat_bysource,					  nf_nat_bysource_params);		if (err)			return NF_DROP;	}	/* It's done. */	if (maniptype == NF_NAT_MANIP_DST)		ct->status |= IPS_DST_NAT_DONE;	else		ct->status |= IPS_SRC_NAT_DONE;	return NF_ACCEPT;}EXPORT_SYMBOL(nf_nat_setup_info);static unsigned int__nf_nat_alloc_null_binding(struct nf_conn *ct, enum nf_nat_manip_type manip){	/* Force range to this IP; let proto decide mapping for	 * per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).	 * Use reply in case it's already been mangled (eg local packet).	 */	union nf_inet_addr ip =		(manip == NF_NAT_MANIP_SRC ?		ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3 :		ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3);	struct nf_nat_range range = {		.flags		= NF_NAT_RANGE_MAP_IPS,		.min_addr	= ip,		.max_addr	= ip,	};	return nf_nat_setup_info(ct, &range, manip);}unsigned intnf_nat_alloc_null_binding(struct nf_conn *ct, unsigned int hooknum){	return __nf_nat_alloc_null_binding(ct, HOOK2MANIP(hooknum));}EXPORT_SYMBOL_GPL(nf_nat_alloc_null_binding);/* Do packet manipulations according to nf_nat_setup_info. */unsigned int nf_nat_packet(struct nf_conn *ct,			   enum ip_conntrack_info ctinfo,			   unsigned int hooknum,			   struct sk_buff *skb)//.........这里部分代码省略.........

static unsigned intnf_nat_fn(unsigned int hooknum,	  struct sk_buff *skb,	  const struct net_device *in,	  const struct net_device *out,	  int (*okfn)(struct sk_buff *)){	struct nf_conn *ct;	enum ip_conntrack_info ctinfo;	struct nf_conn_nat *nat;	/* maniptype == SRC for postrouting. */	enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);	/* We never see fragments: conntrack defrags on pre-routing	   and local-out, and nf_nat_out protects post-routing. */	NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)));	ct = nf_ct_get(skb, &ctinfo);	/* Can't track?  It's not due to stress, or conntrack would	   have dropped it.  Hence it's the user's responsibilty to	   packet filter it out, or implement conntrack/NAT for that	   protocol. 8) --RR */	if (!ct) {		/* Exception: ICMP redirect to new connection (not in		   hash table yet).  We must not let this through, in		   case we're doing NAT to the same network. */		if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {			struct icmphdr _hdr, *hp;			hp = skb_header_pointer(skb, ip_hdrlen(skb),						sizeof(_hdr), &_hdr);			if (hp != NULL &&			    hp->type == ICMP_REDIRECT)				return NF_DROP;		}		return NF_ACCEPT;	}	/* Don't try to NAT if this packet is not conntracked */	if (ct == &nf_conntrack_untracked)		return NF_ACCEPT;	nat = nfct_nat(ct);	if (!nat)		return NF_ACCEPT;	switch (ctinfo) {	case IP_CT_RELATED:	case IP_CT_RELATED+IP_CT_IS_REPLY:		if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {			if (!nf_nat_icmp_reply_translation(ct, ctinfo,							   hooknum, skb))				return NF_DROP;			else				return NF_ACCEPT;		}		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */	case IP_CT_NEW:		/* Seen it before?  This can happen for loopback, retrans,		   or local packets.. */		if (!nf_nat_initialized(ct, maniptype)) {			unsigned int ret;			if (unlikely(nf_ct_is_confirmed(ct)))				/* NAT module was loaded late */				ret = alloc_null_binding_confirmed(ct, hooknum);			else if (hooknum == NF_IP_LOCAL_IN)				/* LOCAL_IN hook doesn't have a chain!  */				ret = alloc_null_binding(ct, hooknum);			else				ret = nf_nat_rule_find(skb, hooknum, in, out,						       ct);			if (ret != NF_ACCEPT) {				return ret;			}			ipt_cone_place_in_hashes(ct);					} else			DEBUGP("Already setup manip %s for ct %p/n",			       maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",			       ct);		break;	default:		/* ESTABLISHED */		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||			     ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));	}	return nf_nat_packet(ct, ctinfo, hooknum, skb);}

static unsigned intpptp_nat_expected(struct sk_buff **pskb,                  unsigned int hooknum,                  struct ip_conntrack *ct,                  struct ip_nat_info *info){        struct ip_conntrack *master = master_ct(ct);        struct ip_nat_multi_range mr;        struct ip_ct_pptp_master *ct_pptp_info;        struct ip_nat_pptp *nat_pptp_info;        u_int32_t newip, newcid;        int ret;        IP_NF_ASSERT(info);        IP_NF_ASSERT(master);        IP_NF_ASSERT(!(info->initialized & (1 << HOOK2MANIP(hooknum))));        DEBUGP("we have a connection!/n");        LOCK_BH(&ip_pptp_lock);        ct_pptp_info = &master->help.ct_pptp_info;        nat_pptp_info = &master->nat.help.nat_pptp_info;        /* need to alter GRE tuple because conntrack expectfn() used 'wrong'         * (unmanipulated) values */        if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_DST) {                DEBUGP("completing tuples with NAT info /n");                /* we can do this, since we're unconfirmed */                if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.gre.key ==                        htonl(ct_pptp_info->pac_call_id)) {                                /* assume PNS->PAC */                        ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.gre.key =                                htonl(nat_pptp_info->pns_call_id);                        ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.gre.key =                                htonl(nat_pptp_info->pns_call_id);                        newip = master->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip;                        newcid = htonl(nat_pptp_info->pac_call_id);                } else {                        /* assume PAC->PNS */                        ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.gre.key =                                htonl(nat_pptp_info->pac_call_id);                        ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.gre.key =                                htonl(nat_pptp_info->pac_call_id);                        newip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;                        newcid = htonl(nat_pptp_info->pns_call_id);                }        } else {                if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.gre.key ==                        htonl(ct_pptp_info->pac_call_id)) {                                /* assume PNS->PAC */                        newip = master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;                        newcid = htonl(ct_pptp_info->pns_call_id);                }                else {                        /* assume PAC->PNS */                        newip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;                        newcid = htonl(ct_pptp_info->pac_call_id);                }        }        mr.rangesize = 1;        mr.range[0].flags = IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED;        mr.range[0].min_ip = mr.range[0].max_ip = newip;        mr.range[0].min = mr.range[0].max =                 ((union ip_conntrack_manip_proto ) { newcid }); 

static unsigned inttalk_nat_expected(struct sk_buff **pskb,		  unsigned int hooknum,		  struct ip_conntrack *ct,		  struct ip_nat_info *info){	struct ip_nat_multi_range mr;	u_int32_t newdstip, newsrcip, newip;	u_int16_t port;	unsigned int ret;		struct ip_conntrack *master = master_ct(ct);	IP_NF_ASSERT(info);	IP_NF_ASSERT(master);	IP_NF_ASSERT(!(info->initialized & (1<<HOOK2MANIP(hooknum))));	DEBUGP("ip_nat_talk_expected: We have a connection!/n");	LOCK_BH(&ip_talk_lock);	port = ct->master->help.exp_talk_info.port;	UNLOCK_BH(&ip_talk_lock);	DEBUGP("ip_nat_talk_expected: dir %s at hook %s, ct %p, master %p/n",	       CTINFO2DIR((*pskb)->nfct - ct->infos) == IP_CT_DIR_ORIGINAL ? "ORIG" : "REPLY",	       hooknum == NF_IP_POST_ROUTING ? "POSTROUTING"	       : hooknum == NF_IP_PRE_ROUTING ? "PREROUTING"	       : hooknum == NF_IP_LOCAL_OUT ? "OUTPUT" : "???",	       ct, master);	if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum == IPPROTO_UDP) {		/* Callee client -> caller server */#ifdef IP_NAT_TALK_DEBUG		struct iphdr *iph = (*pskb)->nh.iph;		struct udphdr *udph = (void *)iph + iph->ihl * 4;		DEBUGP("ip_nat_talk_expected: UDP %u.%u.%u.%u:%u->%u.%u.%u.%u:%u/n",		       NIPQUAD(iph->saddr), ntohs(udph->source),		       NIPQUAD(iph->daddr), ntohs(udph->dest));#endif		newdstip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;		newsrcip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;		DEBUGP("ip_nat_talk_expected: callee client -> caller server, newsrc: %u.%u.%u.%u, newdst: %u.%u.%u.%u/n",		       NIPQUAD(newsrcip), NIPQUAD(newdstip));	} else {		/* Callee client -> caller client */#ifdef IP_NAT_TALK_DEBUG		struct iphdr *iph = (*pskb)->nh.iph;		struct tcphdr *tcph = (void *)iph + iph->ihl * 4;		DEBUGP("ip_nat_talk_expected: TCP %u.%u.%u.%u:%u->%u.%u.%u.%u:%u/n",		       NIPQUAD(iph->saddr), ntohs(tcph->source),		       NIPQUAD(iph->daddr), ntohs(tcph->dest));#endif		newdstip = master->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip;		newsrcip = master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;		DEBUGP("ip_nat_talk_expected: callee client -> caller client, newsrc: %u.%u.%u.%u, newdst: %u.%u.%u.%u/n",		       NIPQUAD(newsrcip), NIPQUAD(newdstip));	}	if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC)		newip = newsrcip;	else		newip = newdstip;	DEBUGP("ip_nat_talk_expected: IP to %u.%u.%u.%u, port %u/n", NIPQUAD(newip), ntohs(port));	mr.rangesize = 1;	/* We don't want to manip the per-protocol, just the IPs... */	mr.range[0].flags = IP_NAT_RANGE_MAP_IPS;	mr.range[0].min_ip = mr.range[0].max_ip = newip;		/* ... unless we're doing a MANIP_DST, in which case, make	   sure we map to the correct port */	if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_DST) {		mr.range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED;		mr.range[0].min = mr.range[0].max			= ((union ip_conntrack_manip_proto)				{ .udp = { port } });

static unsigned intip_nat_fn(unsigned int hooknum,	  struct sk_buff **pskb,	  const struct net_device *in,	  const struct net_device *out,	  int (*okfn)(struct sk_buff *)){	struct ip_conntrack *ct;	enum ip_conntrack_info ctinfo;	struct ip_nat_info *info;	/* maniptype == SRC for postrouting. */	enum ip_nat_manip_type maniptype = HOOK2MANIP(hooknum);/* jimmy added 20080324 */	struct sip_rtp_binding *sip_rtp_binding_tmp = NULL;/* --------------------------------- */	/* We never see fragments: conntrack defrags on pre-routing	   and local-out, and ip_nat_out protects post-routing. */	IP_NF_ASSERT(!((*pskb)->nh.iph->frag_off		       & htons(IP_MF|IP_OFFSET)));	/* If we had a hardware checksum before, it's now invalid */	if ((*pskb)->ip_summed == CHECKSUM_HW)		if (skb_checksum_help(*pskb, (out == NULL)))			return NF_DROP;	ct = ip_conntrack_get(*pskb, &ctinfo);	/* Can't track?  It's not due to stress, or conntrack would	   have dropped it.  Hence it's the user's responsibilty to	   packet filter it out, or implement conntrack/NAT for that	   protocol. 8) --RR */	if (!ct) {		/* Exception: ICMP redirect to new connection (not in                   hash table yet).  We must not let this through, in                   case we're doing NAT to the same network. */		if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {			struct icmphdr _hdr, *hp;			hp = skb_header_pointer(*pskb,						(*pskb)->nh.iph->ihl*4,						sizeof(_hdr), &_hdr);			if (hp != NULL &&			    hp->type == ICMP_REDIRECT)				return NF_DROP;		}		return NF_ACCEPT;	}	/* Don't try to NAT if this packet is not conntracked */	if (ct == &ip_conntrack_untracked)		return NF_ACCEPT;	switch (ctinfo) {	case IP_CT_RELATED:	case IP_CT_RELATED+IP_CT_IS_REPLY:		if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {			if (!ip_nat_icmp_reply_translation(pskb, ct, maniptype,							   CTINFO2DIR(ctinfo)))				return NF_DROP;			else				return NF_ACCEPT;		}		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */	case IP_CT_NEW:		info = &ct->nat.info;		/* Seen it before?  This can happen for loopback, retrans,		   or local packets.. */		if (!ip_nat_initialized(ct, maniptype)) {			unsigned int ret;			if (unlikely(is_confirmed(ct)))				/* NAT module was loaded late */				ret = alloc_null_binding_confirmed(ct, info,				                                   hooknum);			else if (hooknum == NF_IP_LOCAL_IN)				/* LOCAL_IN hook doesn't have a chain!  */				ret = alloc_null_binding(ct, info, hooknum);			else{				ret = ip_nat_rule_find(pskb, hooknum,						       in, out, ct,						       info);/* jimmy added 20080324 */				if((hooknum == NF_IP_POST_ROUTING) && ((*pskb)->nh.iph->protocol == IPPROTO_UDP)){					sip_rtp_binding_tmp = sip_rtp_binding_find(ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip,										ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip);					if(sip_rtp_binding_tmp){					/* jimmy added 20080328, for avoid sip pattern 100 run through in */						if( sip_rtp_binding_tmp->wan_uac_port && 							(ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u.all == sip_rtp_binding_tmp->wan_uac_port)){					/* ----------------------------------------------- */						if(sip_rtp_binding_tmp->router_port && sip_rtp_binding_tmp->router_ip &&							(sip_rtp_binding_tmp->router_ip == ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip) &&							(sip_rtp_binding_tmp->router_port != ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.all)){							write_lock_bh(&ip_conntrack_lock);							ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u.all = sip_rtp_binding_tmp->router_port;							write_unlock_bh(&ip_conntrack_lock);							DEBUGP("After modified conntrack for sip incoming conntrack hash, this ct are/n");							DEBUGP("[IP_CT_DIR_REPLY] : %u %u.%u.%u.%u:%hu -> %u.%u.%u.%u:%hu/n",//.........这里部分代码省略.........

static unsigned intip_nat_fn(unsigned int hooknum,	  struct sk_buff **pskb,	  const struct net_device *in,	  const struct net_device *out,	  int (*okfn)(struct sk_buff *)){	struct ip_conntrack *ct;	enum ip_conntrack_info ctinfo;	struct ip_nat_info *info;	/* maniptype == SRC for postrouting. */	enum ip_nat_manip_type maniptype = HOOK2MANIP(hooknum);	/* We never see fragments: conntrack defrags on pre-routing	   and local-out, and ip_nat_out protects post-routing. */	IP_NF_ASSERT(!((*pskb)->nh.iph->frag_off		       & htons(IP_MF|IP_OFFSET)));	(*pskb)->nfcache |= NFC_UNKNOWN;	/* If we had a hardware checksum before, it's now invalid */	if ((*pskb)->ip_summed == CHECKSUM_HW)		(*pskb)->ip_summed = CHECKSUM_NONE;	ct = ip_conntrack_get(*pskb, &ctinfo);	/* Can't track?  It's not due to stress, or conntrack would	   have dropped it.  Hence it's the user's responsibilty to	   packet filter it out, or implement conntrack/NAT for that	   protocol. 8) --RR */	if (!ct) {		/* Exception: ICMP redirect to new connection (not in                   hash table yet).  We must not let this through, in                   case we're doing NAT to the same network. */		struct iphdr *iph = (*pskb)->nh.iph;		struct icmphdr *hdr = (struct icmphdr *)			((u_int32_t *)iph + iph->ihl);		if (iph->protocol == IPPROTO_ICMP		    && hdr->type == ICMP_REDIRECT)			return NF_DROP;		return NF_ACCEPT;	}	switch (ctinfo) {	case IP_CT_RELATED:	case IP_CT_RELATED+IP_CT_IS_REPLY:		if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {			return icmp_reply_translation(*pskb, ct, hooknum,						      CTINFO2DIR(ctinfo));		}		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */	case IP_CT_NEW:#ifdef CONFIG_IP_NF_NAT_LOCAL		/* LOCAL_IN hook doesn't have a chain and thus doesn't care		 * about new packets -HW */		if (hooknum == NF_IP_LOCAL_IN)			return NF_ACCEPT;#endif		info = &ct->nat.info;		WRITE_LOCK(&ip_nat_lock);		/* Seen it before?  This can happen for loopback, retrans,		   or local packets.. */		if (!(info->initialized & (1 << maniptype))) {			int in_hashes = info->initialized;			unsigned int ret;			if (ct->master			    && master_ct(ct)->nat.info.helper			    && master_ct(ct)->nat.info.helper->expect) {				ret = call_expect(master_ct(ct), pskb, 						  hooknum, ct, info);			} else {				ret = ip_nat_rule_find(pskb, hooknum, in, out,						       ct, info);			}			if (ret != NF_ACCEPT) {				WRITE_UNLOCK(&ip_nat_lock);				return ret;			}			if (in_hashes) {				IP_NF_ASSERT(info->bysource.conntrack);				replace_in_hashes(ct, info);			} else {				place_in_hashes(ct, info);			}		} else			DEBUGP("Already setup manip %s for ct %p/n",			       maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",			       ct);		WRITE_UNLOCK(&ip_nat_lock);		break;	default:		/* ESTABLISHED */		IP_NF_ASSERT(ctinfo == IP_CT_ESTABLISHED			     || ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));		info = &ct->nat.info;	}//.........这里部分代码省略.........

int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,				    struct nf_conn *ct,				    enum ip_conntrack_info ctinfo,				    unsigned int hooknum,				    unsigned int hdrlen){	struct {		struct icmp6hdr	icmp6;		struct ipv6hdr	ip6;	} *inside;	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);	enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);	const struct nf_nat_l4proto *l4proto;	struct nf_conntrack_tuple target;	unsigned long statusbit;	NF_CT_ASSERT(ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY);	if (!skb_make_writable(skb, hdrlen + sizeof(*inside)))		return 0;	if (nf_ip6_checksum(skb, hooknum, hdrlen, IPPROTO_ICMPV6))		return 0;	inside = (void *)skb->data + hdrlen;	if (inside->icmp6.icmp6_type == NDISC_REDIRECT) {		if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)			return 0;		if (ct->status & IPS_NAT_MASK)			return 0;	}	if (manip == NF_NAT_MANIP_SRC)		statusbit = IPS_SRC_NAT;	else		statusbit = IPS_DST_NAT;	/* Invert if this is reply direction */	if (dir == IP_CT_DIR_REPLY)		statusbit ^= IPS_NAT_MASK;	if (!(ct->status & statusbit))		return 1;	l4proto = __nf_nat_l4proto_find(NFPROTO_IPV6, inside->ip6.nexthdr);	if (!nf_nat_ipv6_manip_pkt(skb, hdrlen + sizeof(inside->icmp6),				   l4proto, &ct->tuplehash[!dir].tuple, !manip))		return 0;	if (skb->ip_summed != CHECKSUM_PARTIAL) {		struct ipv6hdr *ipv6h = ipv6_hdr(skb);		inside = (void *)skb->data + hdrlen;		inside->icmp6.icmp6_cksum = 0;		inside->icmp6.icmp6_cksum =			csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,					skb->len - hdrlen, IPPROTO_ICMPV6,					csum_partial(&inside->icmp6,						     skb->len - hdrlen, 0));	}	nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);	l4proto = __nf_nat_l4proto_find(NFPROTO_IPV6, IPPROTO_ICMPV6);	if (!nf_nat_ipv6_manip_pkt(skb, 0, l4proto, &target, manip))		return 0;	return 1;}

static unsigned inth225_nat_expected(struct sk_buff **pskb,		  unsigned int hooknum,		  struct ip_conntrack *ct,		  struct ip_nat_info *info){	struct ip_nat_multi_range mr;	u_int32_t newdstip, newsrcip, newip;	u_int16_t port;	struct ip_ct_h225_expect *exp_info;	struct ip_ct_h225_master *master_info;	struct ip_conntrack *master = master_ct(ct);	unsigned int is_h225, ret;		IP_NF_ASSERT(info);	IP_NF_ASSERT(master);	IP_NF_ASSERT(!(info->initialized & (1<<HOOK2MANIP(hooknum))));	DEBUGP("h225_nat_expected: We have a connection!/n");	master_info = &ct->master->expectant->help.ct_h225_info;	exp_info = &ct->master->help.exp_h225_info;	LOCK_BH(&ip_h323_lock);	DEBUGP("master: ");	DUMP_TUPLE(&master->tuplehash[IP_CT_DIR_ORIGINAL].tuple);	DUMP_TUPLE(&master->tuplehash[IP_CT_DIR_REPLY].tuple);	DEBUGP("conntrack: ");	DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);	if (exp_info->dir == IP_CT_DIR_ORIGINAL) {		/* Make connection go to the client. */		newdstip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;		newsrcip = master->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip;		DEBUGP("h225_nat_expected: %u.%u.%u.%u->%u.%u.%u.%u (to client)/n",		       NIPQUAD(newsrcip), NIPQUAD(newdstip));	} else {		/* Make the connection go to the server */		newdstip = master->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip;		newsrcip = master->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip;		DEBUGP("h225_nat_expected: %u.%u.%u.%u->%u.%u.%u.%u (to server)/n",		       NIPQUAD(newsrcip), NIPQUAD(newdstip));	}	port = exp_info->port;	is_h225 = master_info->is_h225 == H225_PORT;	UNLOCK_BH(&ip_h323_lock);		if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC)		newip = newsrcip;	else		newip = newdstip;	DEBUGP("h225_nat_expected: IP to %u.%u.%u.%u/n", NIPQUAD(newip));	mr.rangesize = 1;	/* We don't want to manip the per-protocol, just the IPs... */	mr.range[0].flags = IP_NAT_RANGE_MAP_IPS;	mr.range[0].min_ip = mr.range[0].max_ip = newip;	/* ... unless we're doing a MANIP_DST, in which case, make	   sure we map to the correct port */	if (HOOK2MANIP(hooknum) == IP_NAT_MANIP_DST) {		mr.range[0].flags |= IP_NAT_RANGE_PROTO_SPECIFIED;		mr.range[0].min = mr.range[0].max			= ((union ip_conntrack_manip_proto)				{ .tcp = { port } });

static unsigned intip_nat_fn(unsigned int hooknum,	  struct sk_buff **pskb,	  const struct net_device *in,	  const struct net_device *out,	  int (*okfn)(struct sk_buff *)){	struct ip_conntrack *ct;	enum ip_conntrack_info ctinfo;	struct ip_nat_info *info;	/* maniptype == SRC for postrouting. */	enum ip_nat_manip_type maniptype = HOOK2MANIP(hooknum);	/* We never see fragments: conntrack defrags on pre-routing	   and local-out, and ip_nat_out protects post-routing. */	IP_NF_ASSERT(!((*pskb)->nh.iph->frag_off		       & __constant_htons(IP_MF|IP_OFFSET)));	(*pskb)->nfcache |= NFC_UNKNOWN;	/* If we had a hardware checksum before, it's now invalid */	if ((*pskb)->pkt_type != PACKET_LOOPBACK)		(*pskb)->ip_summed = CHECKSUM_NONE;	ct = ip_conntrack_get(*pskb, &ctinfo);	/* Can't track?  Maybe out of memory: this would make NAT           unreliable. */	if (!ct) {		if (net_ratelimit())			printk(KERN_DEBUG "NAT: %u dropping untracked packet %p %u %u.%u.%u.%u -> %u.%u.%u.%u/n",			       hooknum,			       *pskb,			       (*pskb)->nh.iph->protocol,			       NIPQUAD((*pskb)->nh.iph->saddr),			       NIPQUAD((*pskb)->nh.iph->daddr));		return NF_DROP;	}	switch (ctinfo) {	case IP_CT_RELATED:	case IP_CT_RELATED+IP_CT_IS_REPLY:		if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {			return icmp_reply_translation(*pskb, ct, hooknum,						      CTINFO2DIR(ctinfo));		}		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */	case IP_CT_NEW:		info = &ct->nat.info;		WRITE_LOCK(&ip_nat_lock);		/* Seen it before?  This can happen for loopback, retrans,		   or local packets.. */		if (!(info->initialized & (1 << maniptype))) {			int in_hashes = info->initialized;			unsigned int ret;			ret = ip_nat_rule_find(pskb, hooknum, in, out,					       ct, info);			if (ret != NF_ACCEPT) {				WRITE_UNLOCK(&ip_nat_lock);				return ret;			}			if (in_hashes) {				IP_NF_ASSERT(info->bysource.conntrack);				replace_in_hashes(ct, info);			} else {				place_in_hashes(ct, info);			}		} else			DEBUGP("Already setup manip %s for ct %p/n",			       maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",			       ct);		WRITE_UNLOCK(&ip_nat_lock);		break;	default:		/* ESTABLISHED */		IP_NF_ASSERT(ctinfo == IP_CT_ESTABLISHED			     || ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));		info = &ct->nat.info;	}	IP_NF_ASSERT(info);	return do_bindings(ct, ctinfo, info, hooknum, pskb);}

static unsigned intip_nat_fn(unsigned int hooknum,	  struct sk_buff **pskb,	  const struct net_device *in,	  const struct net_device *out,	  int (*okfn)(struct sk_buff *)){	struct ip_conntrack *ct;	enum ip_conntrack_info ctinfo;	struct ip_nat_info *info;	/* maniptype == SRC for postrouting. */	enum ip_nat_manip_type maniptype = HOOK2MANIP(hooknum);	/* We never see fragments: conntrack defrags on pre-routing	   and local-out, and ip_nat_out protects post-routing. */	IP_NF_ASSERT(!((*pskb)->nh.iph->frag_off		       & htons(IP_MF|IP_OFFSET)));	(*pskb)->nfcache |= NFC_UNKNOWN;	/* If we had a hardware checksum before, it's now invalid */	if ((*pskb)->ip_summed == CHECKSUM_HW)		if (skb_checksum_help(*pskb, (out == NULL)))			return NF_DROP;	ct = ip_conntrack_get(*pskb, &ctinfo);	/* Can't track?  It's not due to stress, or conntrack would	   have dropped it.  Hence it's the user's responsibilty to	   packet filter it out, or implement conntrack/NAT for that	   protocol. 8) --RR */	if (!ct) {		/* Exception: ICMP redirect to new connection (not in                   hash table yet).  We must not let this through, in                   case we're doing NAT to the same network. */		if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {			struct icmphdr _hdr, *hp;			hp = skb_header_pointer(*pskb,						(*pskb)->nh.iph->ihl*4,						sizeof(_hdr), &_hdr);			if (hp != NULL &&			    hp->type == ICMP_REDIRECT)				return NF_DROP;		}		return NF_ACCEPT;	}	switch (ctinfo) {	case IP_CT_RELATED:	case IP_CT_RELATED+IP_CT_IS_REPLY:		if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {			if (!icmp_reply_translation(pskb, ct, maniptype,						    CTINFO2DIR(ctinfo)))				return NF_DROP;			else				return NF_ACCEPT;		}		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */	case IP_CT_NEW:		info = &ct->nat.info;		/* Seen it before?  This can happen for loopback, retrans,		   or local packets.. */		if (!ip_nat_initialized(ct, maniptype)) {			unsigned int ret;			/* LOCAL_IN hook doesn't have a chain!  */			if (hooknum == NF_IP_LOCAL_IN)				ret = alloc_null_binding(ct, info, hooknum);			else				ret = ip_nat_rule_find(pskb, hooknum,						       in, out, ct,						       info);			if (ret != NF_ACCEPT) {				return ret;			}		} else			DEBUGP("Already setup manip %s for ct %p/n",			       maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",			       ct);		break;	default:		/* ESTABLISHED */		IP_NF_ASSERT(ctinfo == IP_CT_ESTABLISHED			     || ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));		info = &ct->nat.info;	}	IP_NF_ASSERT(info);	return nat_packet(ct, ctinfo, hooknum, pskb);}

unsigned intnf_nat_ipv4_fn(void *priv, struct sk_buff *skb,	       const struct nf_hook_state *state,	       unsigned int (*do_chain)(void *priv,					struct sk_buff *skb,					const struct nf_hook_state *state,					struct nf_conn *ct)){	struct nf_conn *ct;	enum ip_conntrack_info ctinfo;	struct nf_conn_nat *nat;	/* maniptype == SRC for postrouting. */	enum nf_nat_manip_type maniptype = HOOK2MANIP(state->hook);	ct = nf_ct_get(skb, &ctinfo);	/* Can't track?  It's not due to stress, or conntrack would	 * have dropped it.  Hence it's the user's responsibilty to	 * packet filter it out, or implement conntrack/NAT for that	 * protocol. 8) --RR	 */	if (!ct)		return NF_ACCEPT;	nat = nfct_nat(ct);	switch (ctinfo) {	case IP_CT_RELATED:	case IP_CT_RELATED_REPLY:		if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {			if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,							   state->hook))				return NF_DROP;			else				return NF_ACCEPT;		}		/* Only ICMPs can be IP_CT_IS_REPLY: */		/* fall through */	case IP_CT_NEW:		/* Seen it before?  This can happen for loopback, retrans,		 * or local packets.		 */		if (!nf_nat_initialized(ct, maniptype)) {			unsigned int ret;			ret = do_chain(priv, skb, state, ct);			if (ret != NF_ACCEPT)				return ret;			if (nf_nat_initialized(ct, HOOK2MANIP(state->hook)))				break;			ret = nf_nat_alloc_null_binding(ct, state->hook);			if (ret != NF_ACCEPT)				return ret;		} else {			pr_debug("Already setup manip %s for ct %p/n",				 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",				 ct);			if (nf_nat_oif_changed(state->hook, ctinfo, nat,					       state->out))				goto oif_changed;		}		break;	default:		/* ESTABLISHED */		WARN_ON(ctinfo != IP_CT_ESTABLISHED &&			ctinfo != IP_CT_ESTABLISHED_REPLY);		if (nf_nat_oif_changed(state->hook, ctinfo, nat, state->out))			goto oif_changed;	}	return nf_nat_packet(ct, ctinfo, state->hook, skb);oif_changed:	nf_ct_kill_acct(ct, ctinfo, skb);	return NF_DROP;}

static unsigned intnf_nat_ipv4_fn(const struct nf_hook_ops *ops,	       struct sk_buff *skb,	       const struct net_device *in,	       const struct net_device *out,	       int (*okfn)(struct sk_buff *)){	struct nf_conn *ct;	enum ip_conntrack_info ctinfo;	struct nf_conn_nat *nat;	/* maniptype == SRC for postrouting. */	enum nf_nat_manip_type maniptype = HOOK2MANIP(ops->hooknum);	/* We never see fragments: conntrack defrags on pre-routing	 * and local-out, and nf_nat_out protects post-routing.	 */	NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb)));	ct = nf_ct_get(skb, &ctinfo);	/* Can't track?  It's not due to stress, or conntrack would	 * have dropped it.  Hence it's the user's responsibilty to	 * packet filter it out, or implement conntrack/NAT for that	 * protocol. 8) --RR	 */	if (!ct)		return NF_ACCEPT;	/* Don't try to NAT if this packet is not conntracked */	if (nf_ct_is_untracked(ct))		return NF_ACCEPT;	nat = nfct_nat(ct);	if (!nat) {		/* NAT module was loaded late. */		if (nf_ct_is_confirmed(ct))			return NF_ACCEPT;		nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);		if (nat == NULL) {			pr_debug("failed to add NAT extension/n");			return NF_ACCEPT;		}	}	switch (ctinfo) {	case IP_CT_RELATED:	case IP_CT_RELATED_REPLY:		if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {			if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,							   ops->hooknum))				return NF_DROP;			else				return NF_ACCEPT;		}		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */	case IP_CT_NEW:		/* Seen it before?  This can happen for loopback, retrans,		 * or local packets.		 */		if (!nf_nat_initialized(ct, maniptype)) {			unsigned int ret;			ret = nf_nat_rule_find(skb, ops->hooknum, in, out, ct);			if (ret != NF_ACCEPT)				return ret;		} else {			pr_debug("Already setup manip %s for ct %p/n",				 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",				 ct);			if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out))				goto oif_changed;		}		break;	default:		/* ESTABLISHED */		NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||			     ctinfo == IP_CT_ESTABLISHED_REPLY);		if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out))			goto oif_changed;	}	return nf_nat_packet(ct, ctinfo, ops->hooknum, skb);oif_changed:	nf_ct_kill_acct(ct, ctinfo, skb);	return NF_DROP;}

static inline intbcm_do_bindings(struct nf_conn *ct,	    enum ip_conntrack_info ctinfo,	    struct sk_buff **pskb,		struct nf_conntrack_l4proto *l4proto){	struct iphdr *iph = ip_hdr(*pskb);	unsigned int i;	static int hn[2] = {NF_IP_PRE_ROUTING, NF_IP_POST_ROUTING};	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);#ifdef HNDCTF	bool enabled = ip_conntrack_is_ipc_allowed(*pskb, NF_IP_PRE_ROUTING);#endif /* HNDCTF */	for (i = 0; i < 2; i++) {		enum nf_nat_manip_type mtype = HOOK2MANIP(hn[i]);		unsigned long statusbit;		if (mtype == IP_NAT_MANIP_SRC)			statusbit = IPS_SRC_NAT;		else			statusbit = IPS_DST_NAT;		/* Invert if this is reply dir. */		if (dir == IP_CT_DIR_REPLY)			statusbit ^= IPS_NAT_MASK;		if (ct->status & statusbit) {			struct nf_conntrack_tuple target;			if (skb_cloned(*pskb) && !(*pskb)->sk) 			{				struct sk_buff *nskb = skb_copy(*pskb, GFP_ATOMIC);				printk("[debug %s:%d] should not happen!!/n" , __FILE__ , __LINE__);				if (!nskb)					return NF_DROP;				kfree_skb(*pskb);				*pskb = nskb;			}			if (skb_dst((*pskb)) == NULL && mtype == IP_NAT_MANIP_SRC) {				struct net_device *dev = (*pskb)->dev;				if (ip_route_input((*pskb), iph->daddr, iph->saddr, iph->tos, dev))					return NF_DROP;				/* Change skb owner */				(*pskb)->dev = skb_dst((*pskb))->dev;			}			/* We are aiming to look like inverse of other direction. */			ipv4_ct_invert_tuple(&target, &ct->tuplehash[!dir].tuple, l4proto);#ifdef HNDCTF			if (enabled)				ip_conntrack_ipct_add(*pskb, hn[i], ct, ctinfo, &target);#endif /* HNDCTF */			if (!bcm_manip_pkt(target.dst.protonum, pskb, 0, &target, mtype))				return NF_DROP;		}	}	return NF_FAST_NAT;}