} else { /* we only allow nat config for new conntracks */ if (cda[CTA_NAT-1]) { err = -EINVAL; goto out_unlock; } 
ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb, 			struct nlmsghdr *nlh, struct nfattr *cda[], int *errp){	struct ip_conntrack_tuple otuple, rtuple;	struct ip_conntrack_tuple_hash *h = NULL;	int err = 0;	DEBUGP("entered %s\n", __FUNCTION__);	if (cda[CTA_TUPLE_ORIG-1]) {		err = ctnetlink_parse_tuple(cda, &otuple, CTA_TUPLE_ORIG);		if (err < 0)			return err;	}	if (cda[CTA_TUPLE_REPLY-1]) {		err = ctnetlink_parse_tuple(cda, &rtuple, CTA_TUPLE_REPLY);		if (err < 0)			return err;	}	write_lock_bh(&ip_conntrack_lock);	if (cda[CTA_TUPLE_ORIG-1])		h = __ip_conntrack_find(&otuple, NULL);	else if (cda[CTA_TUPLE_REPLY-1])		h = __ip_conntrack_find(&rtuple, NULL);	if (h == NULL) {		write_unlock_bh(&ip_conntrack_lock);		DEBUGP("no such conntrack, create new\n");		err = -ENOENT;		if (nlh->nlmsg_flags & NLM_F_CREATE)			err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);		goto out_unlock;	} else {		/* we only allow nat config for new conntracks */		if (cda[CTA_NAT-1]) {			err = -EINVAL;			goto out_unlock;		}	}	/* We manipulate the conntrack inside the global conntrack table lock,	 * so there's no need to increase the refcount */	DEBUGP("conntrack found\n");	err = -EEXIST;	if (!(nlh->nlmsg_flags & NLM_F_EXCL))		err = ctnetlink_change_conntrack(tuplehash_to_ctrack(h), cda);out_unlock:	write_unlock_bh(&ip_conntrack_lock);	return err;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/88aa0429048d08c18f2772782588f953bbbd79be/ip_conntrack_netlink.c/buggy/net/ipv4/netfilter/ip_conntrack_netlink.c