 /* Don't try to NAT if this packet is not conntracked */ if (ct == &ip_conntrack_untracked) return NF_ACCEPT; 
ip_nat_fn(unsigned int hooknum,	  struct sk_buff **pskb,	  const struct net_device *in,	  const struct net_device *out,	  int (*okfn)(struct sk_buff *)){	struct ip_conntrack *ct;	enum ip_conntrack_info ctinfo;	struct ip_nat_info *info;	/* maniptype == SRC for postrouting. */	enum ip_nat_manip_type maniptype = HOOK2MANIP(hooknum);	/* We never see fragments: conntrack defrags on pre-routing	   and local-out, and ip_nat_out protects post-routing. */	IP_NF_ASSERT(!((*pskb)->nh.iph->frag_off		       & htons(IP_MF|IP_OFFSET)));	(*pskb)->nfcache |= NFC_UNKNOWN;	/* If we had a hardware checksum before, it's now invalid */	if ((*pskb)->ip_summed == CHECKSUM_HW)		if (skb_checksum_help(*pskb, (out == NULL)))			return NF_DROP;	ct = ip_conntrack_get(*pskb, &ctinfo);	/* Can't track?  It's not due to stress, or conntrack would	   have dropped it.  Hence it's the user's responsibilty to	   packet filter it out, or implement conntrack/NAT for that	   protocol. 8) --RR */	if (!ct) {		/* Exception: ICMP redirect to new connection (not in                   hash table yet).  We must not let this through, in                   case we're doing NAT to the same network. */		if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {			struct icmphdr _hdr, *hp;			hp = skb_header_pointer(*pskb,						(*pskb)->nh.iph->ihl*4,						sizeof(_hdr), &_hdr);			if (hp != NULL &&			    hp->type == ICMP_REDIRECT)				return NF_DROP;		}		return NF_ACCEPT;	}	switch (ctinfo) {	case IP_CT_RELATED:	case IP_CT_RELATED+IP_CT_IS_REPLY:		if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP) {			if (!icmp_reply_translation(pskb, ct, maniptype,						    CTINFO2DIR(ctinfo)))				return NF_DROP;			else				return NF_ACCEPT;		}		/* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */	case IP_CT_NEW:		info = &ct->nat.info;		/* Seen it before?  This can happen for loopback, retrans,		   or local packets.. */		if (!ip_nat_initialized(ct, maniptype)) {			unsigned int ret;			/* LOCAL_IN hook doesn't have a chain!  */			if (hooknum == NF_IP_LOCAL_IN)				ret = alloc_null_binding(ct, info, hooknum);			else				ret = ip_nat_rule_find(pskb, hooknum,						       in, out, ct,						       info);			if (ret != NF_ACCEPT) {				return ret;			}		} else			DEBUGP("Already setup manip %s for ct %p\n",			       maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",			       ct);		break;	default:		/* ESTABLISHED */		IP_NF_ASSERT(ctinfo == IP_CT_ESTABLISHED			     || ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY));		info = &ct->nat.info;	}	IP_NF_ASSERT(info);	return nat_packet(ct, ctinfo, hooknum, pskb);}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/8b83bc77bf77cc8459cb94e52b08e775104c4c48/ip_nat_standalone.c/buggy/net/ipv4/netfilter/ip_nat_standalone.c