linux/net/netfilter/nf_conntrack_core.c
<<
>>
Prefs
   1/* Connection state tracking for netfilter.  This is separated from,
   2   but required by, the NAT layer; it can also be used by an iptables
   3   extension. */
   4
   5/* (C) 1999-2001 Paul `Rusty' Russell
   6 * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
   7 * (C) 2003,2004 USAGI/WIDE Project <http://www.linux-ipv6.org>
   8 *
   9 * This program is free software; you can redistribute it and/or modify
  10 * it under the terms of the GNU General Public License version 2 as
  11 * published by the Free Software Foundation.
  12 */
  13
  14#include <linux/types.h>
  15#include <linux/netfilter.h>
  16#include <linux/module.h>
  17#include <linux/sched.h>
  18#include <linux/skbuff.h>
  19#include <linux/proc_fs.h>
  20#include <linux/vmalloc.h>
  21#include <linux/stddef.h>
  22#include <linux/slab.h>
  23#include <linux/random.h>
  24#include <linux/jhash.h>
  25#include <linux/err.h>
  26#include <linux/percpu.h>
  27#include <linux/moduleparam.h>
  28#include <linux/notifier.h>
  29#include <linux/kernel.h>
  30#include <linux/netdevice.h>
  31#include <linux/socket.h>
  32#include <linux/mm.h>
  33#include <linux/nsproxy.h>
  34#include <linux/rculist_nulls.h>
  35
  36#include <net/netfilter/nf_conntrack.h>
  37#include <net/netfilter/nf_conntrack_l3proto.h>
  38#include <net/netfilter/nf_conntrack_l4proto.h>
  39#include <net/netfilter/nf_conntrack_expect.h>
  40#include <net/netfilter/nf_conntrack_helper.h>
  41#include <net/netfilter/nf_conntrack_core.h>
  42#include <net/netfilter/nf_conntrack_extend.h>
  43#include <net/netfilter/nf_conntrack_acct.h>
  44#include <net/netfilter/nf_conntrack_ecache.h>
  45#include <net/netfilter/nf_conntrack_zones.h>
  46#include <net/netfilter/nf_conntrack_timestamp.h>
  47#include <net/netfilter/nf_conntrack_timeout.h>
  48#include <net/netfilter/nf_nat.h>
  49#include <net/netfilter/nf_nat_core.h>
  50
  51#define NF_CONNTRACK_VERSION    "0.5.0"
  52
  53int (*nfnetlink_parse_nat_setup_hook)(struct nf_conn *ct,
  54                                      enum nf_nat_manip_type manip,
  55                                      const struct nlattr *attr) __read_mostly;
  56EXPORT_SYMBOL_GPL(nfnetlink_parse_nat_setup_hook);
  57
  58DEFINE_SPINLOCK(nf_conntrack_lock);
  59EXPORT_SYMBOL_GPL(nf_conntrack_lock);
  60
  61unsigned int nf_conntrack_htable_size __read_mostly;
  62EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
  63
  64unsigned int nf_conntrack_max __read_mostly;
  65EXPORT_SYMBOL_GPL(nf_conntrack_max);
  66
  67DEFINE_PER_CPU(struct nf_conn, nf_conntrack_untracked);
  68EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked);
  69
  70unsigned int nf_conntrack_hash_rnd __read_mostly;
  71EXPORT_SYMBOL_GPL(nf_conntrack_hash_rnd);
  72
  73static u32 hash_conntrack_raw(const struct nf_conntrack_tuple *tuple, u16 zone)
  74{
  75        unsigned int n;
  76
  77        /* The direction must be ignored, so we hash everything up to the
  78         * destination ports (which is a multiple of 4) and treat the last
  79         * three bytes manually.
  80         */
  81        n = (sizeof(tuple->src) + sizeof(tuple->dst.u3)) / sizeof(u32);
  82        return jhash2((u32 *)tuple, n, zone ^ nf_conntrack_hash_rnd ^
  83                      (((__force __u16)tuple->dst.u.all << 16) |
  84                      tuple->dst.protonum));
  85}
  86
  87static u32 __hash_bucket(u32 hash, unsigned int size)
  88{
  89        return ((u64)hash * size) >> 32;
  90}
  91
  92static u32 hash_bucket(u32 hash, const struct net *net)
  93{
  94        return __hash_bucket(hash, net->ct.htable_size);
  95}
  96
  97static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
  98                                  u16 zone, unsigned int size)
  99{
 100        return __hash_bucket(hash_conntrack_raw(tuple, zone), size);
 101}
 102
 103static inline u_int32_t hash_conntrack(const struct net *net, u16 zone,
 104                                       const struct nf_conntrack_tuple *tuple)
 105{
 106        return __hash_conntrack(tuple, zone, net->ct.htable_size);
 107}
 108
 109bool
 110nf_ct_get_tuple(const struct sk_buff *skb,
 111                unsigned int nhoff,
 112                unsigned int dataoff,
 113                u_int16_t l3num,
 114                u_int8_t protonum,
 115                struct nf_conntrack_tuple *tuple,
 116                const struct nf_conntrack_l3proto *l3proto,
 117                const struct nf_conntrack_l4proto *l4proto)
 118{
 119        memset(tuple, 0, sizeof(*tuple));
 120
 121        tuple->src.l3num = l3num;
 122        if (l3proto->pkt_to_tuple(skb, nhoff, tuple) == 0)
 123                return false;
 124
 125        tuple->dst.protonum = protonum;
 126        tuple->dst.dir = IP_CT_DIR_ORIGINAL;
 127
 128        return l4proto->pkt_to_tuple(skb, dataoff, tuple);
 129}
 130EXPORT_SYMBOL_GPL(nf_ct_get_tuple);
 131
 132bool nf_ct_get_tuplepr(const struct sk_buff *skb, unsigned int nhoff,
 133                       u_int16_t l3num, struct nf_conntrack_tuple *tuple)
 134{
 135        struct nf_conntrack_l3proto *l3proto;
 136        struct nf_conntrack_l4proto *l4proto;
 137        unsigned int protoff;
 138        u_int8_t protonum;
 139        int ret;
 140
 141        rcu_read_lock();
 142
 143        l3proto = __nf_ct_l3proto_find(l3num);
 144        ret = l3proto->get_l4proto(skb, nhoff, &protoff, &protonum);
 145        if (ret != NF_ACCEPT) {
 146                rcu_read_unlock();
 147                return false;
 148        }
 149
 150        l4proto = __nf_ct_l4proto_find(l3num, protonum);
 151
 152        ret = nf_ct_get_tuple(skb, nhoff, protoff, l3num, protonum, tuple,
 153                              l3proto, l4proto);
 154
 155        rcu_read_unlock();
 156        return ret;
 157}
 158EXPORT_SYMBOL_GPL(nf_ct_get_tuplepr);
 159
 160bool
 161nf_ct_invert_tuple(struct nf_conntrack_tuple *inverse,
 162                   const struct nf_conntrack_tuple *orig,
 163                   const struct nf_conntrack_l3proto *l3proto,
 164                   const struct nf_conntrack_l4proto *l4proto)
 165{
 166        memset(inverse, 0, sizeof(*inverse));
 167
 168        inverse->src.l3num = orig->src.l3num;
 169        if (l3proto->invert_tuple(inverse, orig) == 0)
 170                return false;
 171
 172        inverse->dst.dir = !orig->dst.dir;
 173
 174        inverse->dst.protonum = orig->dst.protonum;
 175        return l4proto->invert_tuple(inverse, orig);
 176}
 177EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
 178
 179static void
 180clean_from_lists(struct nf_conn *ct)
 181{
 182        pr_debug("clean_from_lists(%p)\n", ct);
 183        hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
 184        hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode);
 185
 186        /* Destroy all pending expectations */
 187        nf_ct_remove_expectations(ct);
 188}
 189
 190static void
 191destroy_conntrack(struct nf_conntrack *nfct)
 192{
 193        struct nf_conn *ct = (struct nf_conn *)nfct;
 194        struct net *net = nf_ct_net(ct);
 195        struct nf_conntrack_l4proto *l4proto;
 196
 197        pr_debug("destroy_conntrack(%p)\n", ct);
 198        NF_CT_ASSERT(atomic_read(&nfct->use) == 0);
 199        NF_CT_ASSERT(!timer_pending(&ct->timeout));
 200
 201        /* To make sure we don't get any weird locking issues here:
 202         * destroy_conntrack() MUST NOT be called with a write lock
 203         * to nf_conntrack_lock!!! -HW */
 204        rcu_read_lock();
 205        l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
 206        if (l4proto && l4proto->destroy)
 207                l4proto->destroy(ct);
 208
 209        rcu_read_unlock();
 210
 211        spin_lock_bh(&nf_conntrack_lock);
 212        /* Expectations will have been removed in clean_from_lists,
 213         * except TFTP can create an expectation on the first packet,
 214         * before connection is in the list, so we need to clean here,
 215         * too. */
 216        nf_ct_remove_expectations(ct);
 217
 218        /* We overload first tuple to link into unconfirmed list. */
 219        if (!nf_ct_is_confirmed(ct)) {
 220                BUG_ON(hlist_nulls_unhashed(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode));
 221                hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
 222        }
 223
 224        NF_CT_STAT_INC(net, delete);
 225        spin_unlock_bh(&nf_conntrack_lock);
 226
 227        if (ct->master)
 228                nf_ct_put(ct->master);
 229
 230        pr_debug("destroy_conntrack: returning ct=%p to slab\n", ct);
 231        nf_conntrack_free(ct);
 232}
 233
 234void nf_ct_delete_from_lists(struct nf_conn *ct)
 235{
 236        struct net *net = nf_ct_net(ct);
 237
 238        nf_ct_helper_destroy(ct);
 239        spin_lock_bh(&nf_conntrack_lock);
 240        /* Inside lock so preempt is disabled on module removal path.
 241         * Otherwise we can get spurious warnings. */
 242        NF_CT_STAT_INC(net, delete_list);
 243        clean_from_lists(ct);
 244        spin_unlock_bh(&nf_conntrack_lock);
 245}
 246EXPORT_SYMBOL_GPL(nf_ct_delete_from_lists);
 247
 248static void death_by_event(unsigned long ul_conntrack)
 249{
 250        struct nf_conn *ct = (void *)ul_conntrack;
 251        struct net *net = nf_ct_net(ct);
 252        struct nf_conntrack_ecache *ecache = nf_ct_ecache_find(ct);
 253
 254        BUG_ON(ecache == NULL);
 255
 256        if (nf_conntrack_event(IPCT_DESTROY, ct) < 0) {
 257                /* bad luck, let's retry again */
 258                ecache->timeout.expires = jiffies +
 259                        (random32() % net->ct.sysctl_events_retry_timeout);
 260                add_timer(&ecache->timeout);
 261                return;
 262        }
 263        /* we've got the event delivered, now it's dying */
 264        set_bit(IPS_DYING_BIT, &ct->status);
 265        spin_lock(&nf_conntrack_lock);
 266        hlist_nulls_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
 267        spin_unlock(&nf_conntrack_lock);
 268        nf_ct_put(ct);
 269}
 270
 271void nf_ct_insert_dying_list(struct nf_conn *ct)
 272{
 273        struct net *net = nf_ct_net(ct);
 274        struct nf_conntrack_ecache *ecache = nf_ct_ecache_find(ct);
 275
 276        BUG_ON(ecache == NULL);
 277
 278        /* add this conntrack to the dying list */
 279        spin_lock_bh(&nf_conntrack_lock);
 280        hlist_nulls_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
 281                             &net->ct.dying);
 282        spin_unlock_bh(&nf_conntrack_lock);
 283        /* set a new timer to retry event delivery */
 284        setup_timer(&ecache->timeout, death_by_event, (unsigned long)ct);
 285        ecache->timeout.expires = jiffies +
 286                (random32() % net->ct.sysctl_events_retry_timeout);
 287        add_timer(&ecache->timeout);
 288}
 289EXPORT_SYMBOL_GPL(nf_ct_insert_dying_list);
 290
 291static void death_by_timeout(unsigned long ul_conntrack)
 292{
 293        struct nf_conn *ct = (void *)ul_conntrack;
 294        struct nf_conn_tstamp *tstamp;
 295
 296        tstamp = nf_conn_tstamp_find(ct);
 297        if (tstamp && tstamp->stop == 0)
 298                tstamp->stop = ktime_to_ns(ktime_get_real());
 299
 300        if (!test_bit(IPS_DYING_BIT, &ct->status) &&
 301            unlikely(nf_conntrack_event(IPCT_DESTROY, ct) < 0)) {
 302                /* destroy event was not delivered */
 303                nf_ct_delete_from_lists(ct);
 304                nf_ct_insert_dying_list(ct);
 305                return;
 306        }
 307        set_bit(IPS_DYING_BIT, &ct->status);
 308        nf_ct_delete_from_lists(ct);
 309        nf_ct_put(ct);
 310}
 311
 312/*
 313 * Warning :
 314 * - Caller must take a reference on returned object
 315 *   and recheck nf_ct_tuple_equal(tuple, &h->tuple)
 316 * OR
 317 * - Caller must lock nf_conntrack_lock before calling this function
 318 */
 319static struct nf_conntrack_tuple_hash *
 320____nf_conntrack_find(struct net *net, u16 zone,
 321                      const struct nf_conntrack_tuple *tuple, u32 hash)
 322{
 323        struct nf_conntrack_tuple_hash *h;
 324        struct hlist_nulls_node *n;
 325        unsigned int bucket = hash_bucket(hash, net);
 326
 327        /* Disable BHs the entire time since we normally need to disable them
 328         * at least once for the stats anyway.
 329         */
 330        local_bh_disable();
 331begin:
 332        hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[bucket], hnnode) {
 333                if (nf_ct_tuple_equal(tuple, &h->tuple) &&
 334                    nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)) == zone) {
 335                        NF_CT_STAT_INC(net, found);
 336                        local_bh_enable();
 337                        return h;
 338                }
 339                NF_CT_STAT_INC(net, searched);
 340        }
 341        /*
 342         * if the nulls value we got at the end of this lookup is
 343         * not the expected one, we must restart lookup.
 344         * We probably met an item that was moved to another chain.
 345         */
 346        if (get_nulls_value(n) != bucket) {
 347                NF_CT_STAT_INC(net, search_restart);
 348                goto begin;
 349        }
 350        local_bh_enable();
 351
 352        return NULL;
 353}
 354
 355struct nf_conntrack_tuple_hash *
 356__nf_conntrack_find(struct net *net, u16 zone,
 357                    const struct nf_conntrack_tuple *tuple)
 358{
 359        return ____nf_conntrack_find(net, zone, tuple,
 360                                     hash_conntrack_raw(tuple, zone));
 361}
 362EXPORT_SYMBOL_GPL(__nf_conntrack_find);
 363
 364/* Find a connection corresponding to a tuple. */
 365static struct nf_conntrack_tuple_hash *
 366__nf_conntrack_find_get(struct net *net, u16 zone,
 367                        const struct nf_conntrack_tuple *tuple, u32 hash)
 368{
 369        struct nf_conntrack_tuple_hash *h;
 370        struct nf_conn *ct;
 371
 372        rcu_read_lock();
 373begin:
 374        h = ____nf_conntrack_find(net, zone, tuple, hash);
 375        if (h) {
 376                ct = nf_ct_tuplehash_to_ctrack(h);
 377                if (unlikely(nf_ct_is_dying(ct) ||
 378                             !atomic_inc_not_zero(&ct->ct_general.use)))
 379                        h = NULL;
 380                else {
 381                        if (unlikely(!nf_ct_tuple_equal(tuple, &h->tuple) ||
 382                                     nf_ct_zone(ct) != zone)) {
 383                                nf_ct_put(ct);
 384                                goto begin;
 385                        }
 386                }
 387        }
 388        rcu_read_unlock();
 389
 390        return h;
 391}
 392
 393struct nf_conntrack_tuple_hash *
 394nf_conntrack_find_get(struct net *net, u16 zone,
 395                      const struct nf_conntrack_tuple *tuple)
 396{
 397        return __nf_conntrack_find_get(net, zone, tuple,
 398                                       hash_conntrack_raw(tuple, zone));
 399}
 400EXPORT_SYMBOL_GPL(nf_conntrack_find_get);
 401
 402static void __nf_conntrack_hash_insert(struct nf_conn *ct,
 403                                       unsigned int hash,
 404                                       unsigned int repl_hash)
 405{
 406        struct net *net = nf_ct_net(ct);
 407
 408        hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
 409                           &net->ct.hash[hash]);
 410        hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode,
 411                           &net->ct.hash[repl_hash]);
 412}
 413
 414int
 415nf_conntrack_hash_check_insert(struct nf_conn *ct)
 416{
 417        struct net *net = nf_ct_net(ct);
 418        unsigned int hash, repl_hash;
 419        struct nf_conntrack_tuple_hash *h;
 420        struct hlist_nulls_node *n;
 421        u16 zone;
 422
 423        zone = nf_ct_zone(ct);
 424        hash = hash_conntrack(net, zone,
 425                              &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
 426        repl_hash = hash_conntrack(net, zone,
 427                                   &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 428
 429        spin_lock_bh(&nf_conntrack_lock);
 430
 431        /* See if there's one in the list already, including reverse */
 432        hlist_nulls_for_each_entry(h, n, &net->ct.hash[hash], hnnode)
 433                if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
 434                                      &h->tuple) &&
 435                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
 436                        goto out;
 437        hlist_nulls_for_each_entry(h, n, &net->ct.hash[repl_hash], hnnode)
 438                if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
 439                                      &h->tuple) &&
 440                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
 441                        goto out;
 442
 443        add_timer(&ct->timeout);
 444        nf_conntrack_get(&ct->ct_general);
 445        __nf_conntrack_hash_insert(ct, hash, repl_hash);
 446        NF_CT_STAT_INC(net, insert);
 447        spin_unlock_bh(&nf_conntrack_lock);
 448
 449        return 0;
 450
 451out:
 452        NF_CT_STAT_INC(net, insert_failed);
 453        spin_unlock_bh(&nf_conntrack_lock);
 454        return -EEXIST;
 455}
 456EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
 457
 458/* Confirm a connection given skb; places it in hash table */
 459int
 460__nf_conntrack_confirm(struct sk_buff *skb)
 461{
 462        unsigned int hash, repl_hash;
 463        struct nf_conntrack_tuple_hash *h;
 464        struct nf_conn *ct;
 465        struct nf_conn_help *help;
 466        struct nf_conn_tstamp *tstamp;
 467        struct hlist_nulls_node *n;
 468        enum ip_conntrack_info ctinfo;
 469        struct net *net;
 470        u16 zone;
 471
 472        ct = nf_ct_get(skb, &ctinfo);
 473        net = nf_ct_net(ct);
 474
 475        /* ipt_REJECT uses nf_conntrack_attach to attach related
 476           ICMP/TCP RST packets in other direction.  Actual packet
 477           which created connection will be IP_CT_NEW or for an
 478           expected connection, IP_CT_RELATED. */
 479        if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
 480                return NF_ACCEPT;
 481
 482        zone = nf_ct_zone(ct);
 483        /* reuse the hash saved before */
 484        hash = *(unsigned long *)&ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev;
 485        hash = hash_bucket(hash, net);
 486        repl_hash = hash_conntrack(net, zone,
 487                                   &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 488
 489        /* We're not in hash table, and we refuse to set up related
 490           connections for unconfirmed conns.  But packet copies and
 491           REJECT will give spurious warnings here. */
 492        /* NF_CT_ASSERT(atomic_read(&ct->ct_general.use) == 1); */
 493
 494        /* No external references means no one else could have
 495           confirmed us. */
 496        NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
 497        pr_debug("Confirming conntrack %p\n", ct);
 498
 499        spin_lock_bh(&nf_conntrack_lock);
 500
 501        /* We have to check the DYING flag inside the lock to prevent
 502           a race against nf_ct_get_next_corpse() possibly called from
 503           user context, else we insert an already 'dead' hash, blocking
 504           further use of that particular connection -JM */
 505
 506        if (unlikely(nf_ct_is_dying(ct))) {
 507                spin_unlock_bh(&nf_conntrack_lock);
 508                return NF_ACCEPT;
 509        }
 510
 511        /* See if there's one in the list already, including reverse:
 512           NAT could have grabbed it without realizing, since we're
 513           not in the hash.  If there is, we lost race. */
 514        hlist_nulls_for_each_entry(h, n, &net->ct.hash[hash], hnnode)
 515                if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
 516                                      &h->tuple) &&
 517                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
 518                        goto out;
 519        hlist_nulls_for_each_entry(h, n, &net->ct.hash[repl_hash], hnnode)
 520                if (nf_ct_tuple_equal(&ct->tuplehash[tuplehash[IP_CT_DIR_ORIGINAL]. 421        h->tuple) &&
 517                    zone == nf_ct_zone6170      2"> 512;
nf_conn>(h)))
zon5 = nf_ct_net(h5sh_conntrack(
IP_CT_DIR_ORIGINAL].hash]);
 520                if (hlist_nulls_add_head_rcu(&ct->h5sh_conntrack(nf_conntrack_has5,realioriginfiltfilter/nf_conntrack_core.c#L513" id="L513" class="lf="L518" cple);
,rdr wrap ilter/nf_conntrack_core.c#L477" id="L477" class="line"5ck_bh" cl5ss="sref">spin_lock_bh(&am53/* We're not in hash table, and weweird delanetfselse could have
hlist_nulls_node 443 5      /*5See if there's one in thed="L442" class="line" name="L442"> 442
 443         442
 444        ct->        zon5IP_CT_DIR_ORIGINAL" clas5="sre53ent">           not in the htfilter/nf_conntrack_core.c#L443" id="L443"onntus"line" name="L4onntusnt"> |d="L479" class="linS_CONFIRMED_nulls_add_head_rS_CONFIRMED
h5&           further use of that particular connede=nf_ct_5uplehash_to_ctrack" clas5="sre5">nf_ct_tupleh_core.c#L474" id="L474" cst/netck_core.43">d="L4,],  48dse could have
h5lass="line" name="L436">5436                        gotonntrack_core.c#L466" id="L466" "L481"> 481
;
 506       href="net/netfilter/nf_conntrack_core.c#L518" i a href="5repl_h, unlikel[IP_CT_DIR_REPLYnfp;
0_zone" class="sref">nf_ct_zone6170              5&h->d="L4onntrack_L466" _ntra_43">d="L406" class="line" nam4605441h->L443" id="L443" ntrack_core.c#L466" id="L466" re.c#L443" id="L443"onn6" id="L456" clasonn6"66" "L481"> 481
e=zons"line" name="L4k43">e=zons06" class="line" nam460NF_Aadd_timer5/a>(& ld have
/* No external references m csnn6"ilte4="n43">r /a>
settilte4="nCONFIRMED bit. T="nRCU barriers> ld have
/* ipt_REJECT uses nf_conntra* guaranteeh, blo/a>
adCPUetfn ine"e4="netck_core.b">ctNF_CT_5TAT_INC(spin_unlock_bh(&am54           which created connection  could have
ct_general);
 445        __nf_conntrack_hash_insert(
net de=repl_hash" class="sref">repl_hash);
 446        hlist_nulls_node<+code=ct" class="sref">ct))) {
 507                (<5 href="+code=net" class=5sref"5net,  481
c   de=c06" class="line" name="L506"> 506       href="net/netfilter/nf_conntrack_core.c#L518" i_bh" clas5="sref">spin_unlock_bh(&am5;ct.hash]lter/nf_conntrack_core.c#L50er/nf_cachf_conntrack_core.c#Lore.c#L50er/nf_cachf06" class="line" namIPhasHELPEion, IP_CT_RELATIPhasHELPEic#L446" id="L446" clae="L506"> 506       href="net/netfilter/nf_conntrack_core.c#L518" i_e=nf_ct_5IST;
NF_CT_5L( 506masf_c_e=06" class="line" name="L506"> 506        ?ref="net/netfilter/nf_conntrack_core.c#L518" i_a href="5ert);
 506       href="net/netfilter/nf_conntrack_core.c#L518" i_nntrack_558"> 458net de=>nf_conntrack_lock);
 450
)
 451out:
 452        NF_CT_STAT5  unsigne5 int insert_failed);
 453        nf_conntr_core.c"sref">net de=DROPe=out" class="srefDROPef="net/netfilter/nf_conntrack_core.c#L508" id="L50 454" id=5      struct  455}
 459int
 453        NF_CT_5+code=nf_conn_tstamp" cl5ss="s56k_hash_check_insert" class="sref">nf_conntrack_has5struct 
 465        struct  470        aces i="net/take"}
, aces i="netf">nf/netfilter/nf_conlass="sref">ct->tuplehashss="sref"5zone;
h->, f">nf/netfilter/nf_coignhasd"sref">tupe="L452"> 452tupass="sref">ct.nf_ct_5 "+cod3tinfo5e=repl_hash"+code=h" class="sref">f">nf/netfilter/nflass="sref">unlikel[nf57le_hash *ctinfo;
 452tupass="sref">ct.NF_CT_5+code=nf_crepl_hash;
 463        struct /* ip5_REJE57p *tstamp;
 467        struct            ICMP5TCP R57> *f">nf/netfilter/nf_coignhasd"sref">tupe="k_core.c#L464" id="L464" class="line" name="L464"> 464        str5           w5ich c57#L474" id="L47->net;
 452tupass="sref">ct.NF_CT_5+code=nf_c 461{
 486        repl_hash = tuplehash[cti5fo) !=  580                re5urn <58#L510" id="L510" class="line" name="L5DistrackBHsonntrnamir4="nCOrack_core ness=_codistracknntm a501" id="L501" class="line" name="L501"> 501      sphref="+co5e=nf_ct_zone" class="sre5">nf_58abbed it without realizing, since wea href="net/netfilter/nf_conntrack5L469"> 465      " name="L583"> 483        /* reuse the hash rcuf="neme="L498"> 498
tuplehash[ 486   ="line" name="L519"> 519        hlist_nulls_for_each_entry(h, n, &net->ctunlikel[(58/a>].zone == tuplehash[5et,  47L452"> 452tupass="sref">ct. 421_DIR_REPL5" class="sref">IP_CT_DIR5REPLY58ctrack]lter/nf="net/netfilter/nf_co     ct->IP_CT_DIR_ORIGINAL]. 421repl_hash = unlikel[/* We're5not i59f="+c               goto_ntra_43">d="L4onntr class="sref">out:
tuplehash[           connec5ions 59>[);
tuplehash[   5     59t;, tuplehash[/* NF_CT_ASSER5(atom59_conn>(d="L4onntr class="sref">out:
tuplehash[/* 5o ext59. 495           crcuf="nemsert_failed);
tuplehash[nf_ct_5s_con59 class="sref">nf_conntrack_has5struct "C5nfirming conntrack %5\n&qu59ctrack 448
 455}
aces i="net/take"}
, tuplehash[/* We have6to ch6ck the#def">/a_43">d="L4onntr classEVICTION_RANGEout:
/* NF_CT_ASSER6ainst60_read(&ct->ct_general.use) == 1); */6ent">    6      user context, else6we in6ert an already 'dead'" el
        6  fur60nal references m csnn6"ilte4="dn>
 465     6early_dro" idre.c#L443" iearly_dro"lter/ctinfo;
 461{
nf_ct_5 "+cod3ti6=nf_ct_is6dying" class="sref">nf_c6_is_d6ingunlikel[(&
ldest e.c#L,packet 465     6<9_unlock6bt/netfilter/nf_conntrac6urn <60a>  463        struct  f">nf/netfilter/nf_coignhasd"sref">tupe="k_core.c#L464" id="L464ref="net/netfilterNUL455"> 455}
ct-&"L466" fhref="net/ame="L466"> 466        struct tstamp;
 467        struct /* See if ther6'61L461" id="L461" class="line" name="L461">isd"sref">tupass=ass="line" name="L452cn_core.c#L464" id=n"L464refss="line" name="L448"> 448
           NAT could6have 61_conn>(dro"p        448
    6 class="comment">       6   no61t_net(h5sh_conntr66ash. 498
tuplehash[IP_CT_DIR_O6IGINA6].tupass=ass=refssne" name="L461">isd"sref">tupass=ass= <sne" name="L461">ass="sref">hlist_nulls_for_each_entry(h, isd"sref">tupass=ass=++/likely" class="sref">unlikel[h-&g6; 486   ="line" name="L519"> 519        hlist_nulls_for_each_entry(h, n, &kely" class="sref">unlikel[nf_ct_tuple6ash_t6_ctrack(->ctunlikel[ 518            6     61/a>].zone == tuplehash[repl_6ash],          |d="L479" class="li>nf_ct_zone6170      2"> 512;6T_DIR_tup6ehash" class="sref">tupl6hash<6a>[tupe="k_core.c#L464" id="L464ref="net/netfilter&"L466" fhref="net/ame="L466"> 466        struct 6-6gt;tupe="kn_core.c#L464" id=n"L464++466"> 466        struct 6f_conn>(nf6ct_net(h5sh_conntr6ck( 47NUL455"> 455}
unlikel[IP_CT_DIR_OR6GINAL62/a>]. 505
 506        if (         421(,  506    444        ct->         512;6Tn_unlock6" cl5ss="s528nf_conntrac6_core62ctrack(         421         421(&am53/* We're6not i63],  506   k_core.c#L464" id="L464ref="net/netfilterNUL455"> 455}
         421h6ist_n63>[/*5See if there&639;s 63    goto (<5 href="+c6>(:
 512;6ORIGINAL"6clas5="sre53ent">       6   no63#L493" id="L4oto_ntra        b="nk"+code=tupleL26170         421        6  fur6her use of that particular connede=nf_ct_5uplehash_6o_ctrack"6clas5="sre5">nf_ct_tuple6_core63/a>]. 485        ass="sref">hlist_nulls_for_each_entry(h, (5436            6     6     gotonntra href="+code=EEXIST" class5  struct 5a href="+6nn_unlock6hash5 clas5="sref">repl_6, );
tuplehash[IP_CT_DI6_REPL6tuplehash[h-&g6;tuplehash[ de=DROPe=out" class=dro"p       tuplehash[54416-64    goto (<5 href="+c6 442
 444L443"> 443        unlikel[d="L4onntrdeath_by_L443"> 443        death_by_L443"> e="L5(1" class=long)/nf_conntrack_c     if (tuplehash[/* 6o ext64]lter/nf_conntrack_cor4" cT442"ter/nfi"line" eC
 501     6f="+code=6ash"5class54mment">/* ip6_REJE6T uses nf_conntra* guaranteeh, blo/a>>>>>>>>>>>racivery may n>
 465     6>(,  |d="L479" class="lio/likely" class="sref">unlikel[(&am54           w6ich c64ctrack(dro"p       tuplehash[].out:
tuplehash[h6ist_n6lls_node<+code href="+code=EEXIST" class5  struct 5a href="+6< name="L6="L451" cl55            6     65> 451 e="L506"> 506        if (tuplehash[, tuplehash[6ashitter/nf_conntrack_corne" itter/nf_conntrack_cornee="L5void=lass="sref">tuplehash[unlikel[rane" tuplehash[tuplehash[ de=rep4" cT442"ter/nfi"line" href="net/netfilter/nf_conntrack5L469"> 465     6  465 465     6  name="L6t/ne5filte56s="line" nam6="L4566one in the list already, including r* Becapan>"net/netn.c#L5t e.ough e.c#opynwnen systemre 465     6 a href="6hash5 clas56et, s6_tuple_ha6h" c5ass="5ref">nf_connt6_core66rt an already 'dead' hash, ba href="net/netfilter/nf_conntrack5L469"> 465     6ct unlikel[]. 506   rane" tuplehash[tuplehash[tuplehash[f">nf/netfilter/nf_coignha9" class="line" name="L509k_confirm5/a>(struc6  name="L6et/n5tfilt57lass="sref">6-6gt; 45alloherinc> 442
f="netL453"> 45allohe="L5ctinfo;
->net;
unlikel[f">67_conn>(aces i="netf">nf/netfilter/nf_conlass="sref">ct-conn">aces i="netf"connc#L4>kely" class="sref">unlikel[nf67#L493" id="L4oto_ntra     code=repl_hash" class="sre+code=h" class="sref">aces i="netf">nf/netfilter/nf_conlass="sref">ct-ash_" kely" class="sref">unlikel[(->/*5">net 485        tuplehash[/* ip6_REJE67pikely" class="sref">unlikel[           ICMP6TCP R67> *f">nf/netfilter/nf_coignhasd"sref">tupe="k_core.c#L464" id="L464" class="line" name="L464"> 464        str6           w6ich c67#L474 class="line" name="L464"> 464        str6    6      expected_conntrack_core.c#Lun="L505"> 505
unlikel[cti6fo) != itter/nf_conntrack_corne" itter/nf_conntrack_cornee="L5)class="sref">tuplehash[ 680                re6urn <68>[ 465     6{
 506   conn">aces i="netf"connc#L4>ter/nf_conntrack">repl_hash = tuplehash[nf_68href="+code=NF_ACCEPT" class="sref">NF_Aadd_timer5/a>(&6" name="L683"> 483        (h5sh_conntr6sa href="6code=hnnode" class="sref6>hnno6e. 465     6<      68class="comment">           ce" namgs herinc> 442
hlist_nulls_for_each_entry(h, tuplehash[68 class="sref">nf_conntrack_has5struct IP_CT_DIR6REPLY68ctrack 421 505
           ce" namg="neerinc> 442
hlist_nulls_for_each_entry(h, unlikel[/* We're6not i69f="+c               g"f er/nf_conntrack_cearly_dro" idre.c#L443" iearly_dro"lter/t/netfilter/nf_conntrack_core.c#L469" id,dt->unlikel[ 6mment">           connec6ions 69>[hlist_nulls_for_each_entry(h,          421 4916span class="comment">   6     69t;, "              421o5e=repl6"comment">/* NF_CT_ASSER6(atom69_conn>(         421 name="L6et/netfilter/nf_conntrac6_core6c#L493" id="L4oto_ntraF_ACCEPT" class="sref">NF_Aadd_timer5/a>(&6 a href="6span class="comment">/* 6o ext69. 495NF_CT_5L(n class=6med" class="sref">nf_ct_6s_con69    gotock_cor4" cT442"ter/nfi"line" href="net/netfilter/nf_conntrack5L469"> 465     6">"C6nfirming conntrack %6\n&qu69ated connection  could have
kmeme" nam_zalloh(),5as this " namrpan href="net/netfilter/nf_conntrack5ge=nf_ct_5a>, s7spin_lock7bh(& 465     7 442
kmeme" nam_allohlter/t/netfilter/nf_conntrack_core.c#L469" idr_each_entry(h,  465 465         421/* We have7to ch70t; 455}
unlikel[/* NF_CT_ASSER7ainst70_conn>(hlist_nulls_for_each_entry(h,          421    7      user context, else7we in70#L493" id="L4oto_ntra> de=DROPe=out" class=ERR_PTsHELPEic#L446" iERR_PTslter/-OPe=out" class=ENOMEMHELPEic#L446" iENOMEMef="/"+code=tupleL26170         421        7  fur70. 465     7=nf_ct_is7dying" class="sref">nf_c7_is_d70 packets in othe csns="s at 501     7in_unlock7bh(&s7s9_unlock7bt/netfilter/nf_conntrac7urn <70abbed it wet uNAT)se could havpan>
 465     7net/netfi7ter/nf_conntrack_core.c#7509" 71net de=repl_hash" class=memsss="sref">hlist_nmemssset/netfilter/nf_conntrack_core.c#L443" id="L443"name="L444"> 444Ls="sref"ore.c#L443" id=Ls="sref"443"n, & 465     7na href="7et/netfilter/nf_conntrac7_core71>[ 506   cffsssof">aces i="netf"cffsssofe="L5f">nf/netfilter/nf_coignash_insert" classprotc#L479" id="L479protc" id/l-et/netfilter/nf_conntrack5L469"> 465     7n /* See if ther7'71t;, 06"> 506   cffsssof">aces i="netf"cffsssofe="L5f">nf/netfilter/nf_coignash_insert" classLs="sref"ore.c#L443" id=Ls="sref"443"n, &tuplehash[           NAT could7have 71de=insert_failed" class="sref">inrt_faneitore.c#L443" id=f">inrt_faneitet/netfilter/nf_conntrack_core.c#L443" id="L443"name="L444"> 444rt_fed);
            7 class="comment">       7   no71"comment">/* reuse the hash _core.c#L443" id="L443"name="L444"> 444Ls="sref"ore.c#L443" id=Ls="sref"443"n, &h, ct-conn">aces i="netf"connc#L4 7ash. 444Ls="sref"ore.c#L443" id=Ls="sref"443"n, &h, cth,  455}
         421IP_CT_DIR_O7IGINA71class="comment">           c_core.c#L443" id="L443"name="L444"> 444Ls="sref"ore.c#L443" id=Ls="sref"443"n, &h, ct-ash_"          421h-&g7;
  namca href="net/netfilter/nf_conntrack5L469"> 465     7nn_unlock7class="sref">nf_ct_tuple7ash_t7_ctrack( 444Ls="sref"ore.c#L443" id=Ls="sref"443"n, &h, cth,          421 518            7     71/a>].  atoe4=a href="net/netfilter/nf_conntrack5L469"> 465     7code=repl7hash" class="sref">repl_7ash de=repl_hash" class=sssupkme="L442"> 442
 444L443"> 443         443        death_by_L443"> e="L, (1" class=long)/nf_conntrack_c     if (tuplehash[tupl7hash<72ls_node<+code=ct" class="srewrite_pass="sref">hlist_nwrite_passet/netfilter/nf_conntrack_core.c#L443" id="L443"name="L444"> 444nf_conntrack_core.c#L" id="L473ash_insert" classconntrack_core.c#L469" id)class="sref">tuplehash[7-7gt;NF_CT_5L(72href="+code=N_conntrack_core.c#L">repl_hash = unlikel[nf72#L493" id="L4oto_ntraepl_hash" class="sre+code=h" class=nntrack_core.c#L482" idh" class=nntrL493"et/netfilter/nf_cff_conntrack_core.c#L482" id="L482" clclass="sref">tuplehash[IP_CT_DIR_OR7GINAL72/a>]. 455}
out:
" id)class="sref">tuplehash[, tuplehash[ 506   cut_free">aces i="netf"cut_free" clclass="sref">tuplehash[ 444ie" repl_hash = tuplehash[h7ist_n73>[/*5See if there&739;s 73> 451 465     7 465     7       7   no73rt an already 'dead' hash, ba href="net/netfilter/nf_conntrack5L469"> 465     7ef="+code7h" c5ass="53nt">        7  fur73. 442
tuplehash[nf_ct_tuple7_core73class="comment">           ce" namgsss="sref">hlist_ne" namgssset/netfilter/nf_conntrack_core.c#L443" id="L443"name="L444"> 444nf_     ct->        tuplehash[5436            7     7     gotonntra> de=DROPe=out" class=k_core.c#L464" id="L464" class="line" name="L464"> 464        str7nn_unlock7hash5 clas5="sref">repl_7,  464        str7T_DIR_REP7Y" c5ass="5ref">IP_CT_DI7_REPL7NF_CT_5L(h-&g7;aces i="netf"cut_free" cl:f_conntrack_core.c#L518" i_">NF_CT_5L(hlist_nulls_for_each_entry(h,          42154417-74> 451aces i="netf"kmeme" nam_freelter/t/netfilter/nf_conntrack_core.c#L469" idr_each_entry(h,  465 465tuplehash[ de=DROPe=out" class=ERR_PTsHELPEic#L446" iERR_PTslter/-OPe=out" class=ENOMEMHELPEic#L446" iENOMEMef="/"+code=tupleL26170         421/* 7o ext74]lter href="+code=EEXIST" class5  struct 5a href="+7f="+code=7ash"5class54mment">/* ip7_REJE74ter/nf_conntrack_core.c#L518" i_">NF_CT_5L((code=tstamp" class="srs="sref">f">nf/netfilter/nf_coignhasd"sref">tupe=""netL453"> 45alloherinc> 442
"netL453"> 45allohe="L5ctinfo;
->net;
unlikel[(&am54           w7ich c74ctrack(aces i="netf">nf/netfilter/nf_conlass="sref">ct-conn">aces i="netf"connc#L4>kely" class="sref">unlikel[aces i="netf">nf/netfilter/nf_conlass="sref">ct-ash_" kely" class="sref">unlikel[ct-gfp_nntrack_core.c#Lgfp_n;
tuplehash[h7ist_n7lls_noikely" class="sref">unlikel[ 451 de=DROPe=out" class=f="netL453"> 45alloherinc> 442
f="netL453"> 45allohe="L5t/netfilter/nf_conntrack_core.c#L469" id,dt-> 06"> 506   conn">aces i="netf"connc#L4>ter/nf_conntrackash_"  href="net/netfigfpntrack_core.c#Lgfp" id,d0/"+code=tupleL26170         421,  455}
 442
"netL453"> 45allohe="L/"+code=tupleL26170         4217ashaces i="netf"nede=nf_ct_5ufreee="L5f">nf/netfilter/nf_coignhasd"sref">tupe="k_core.c#L464" id="L464=lass="sref">tuplehash[unlikel[ctinfo;
         421tuplehash[ de=repl_hash" class=er/ncoext_destro5"> 505
         421hlist_nulls_for_each_entry(h,          421aces i="netf"nede"lext_freelter/t/netfilter/nf__core.c#L443" id="L443"/"+code=tupleL26170         421aces i="netf"kmeme" nam_freelter/t/netfilter/nf_conntrack_core.c#L469" idr_each_entry(h,  465 465         421nf_connt7_core76ef="+ href="+code=EEXIST" class5  struct 5a href="+7ct  455}
aces i="netf"nede=nf_ct_5ufreee="L=class="srefeL26170         421NF_CT_5L(NF_CT_5:Ef="> de=DR-ENOMEMe"f  otheificatoe4href="net/netfilter/nf_conntrack5L469"> 465     7oa href="7lls_5ode" 56/nf_conntrac7_core76ated connection  could have 465     7oa href="7clas5="sre56/nf_cT could7have 76#L498 claicecode=ctinfo" class="srerepl_hfilter/nf_c href="net/netfilter/nf_conntrack_core.c#L463" idet/netfilter/nf_conntrack5L469"> 465     7  struct 7a hr5f="+c5de=netConfirm7a con7759" id="L459" class=">itt469"> 465" itt469"> 465e="L5ctinfo;
f">nf/netfilter/nf_coignhasd"sref">tupe="tmh_" kely" class="sref">unlikel[aces i="netf">nf/netfilter/nf_conlass="sref">ct-f="+code=tuplehar8+cod8f="+c3>kely" class="sref">unlikel[7-77t;, epl_hash" class="sre+code=h" class=l3protc#L479" id="L479ode=h" class=l3protconlass="sref">ct-l3protc#L479" id="L479l3protconla>kely" class="sref">unlikel[f">77_conn>(ct-l4protc#L479" id="L479l4protconla>kely" class="sref">unlikel[nf77#L493" id="L4oto_ntrepl_hash" class="sre+csk_buff">aces i="netf"sk_buffonlass="sref">ct-skb442"> 442
kely" class="sref">unlikel[dataoff">aces i="netf"dataoff" id,dt->/*5">net 485        tuplehash[/* ip7_REJE77pikely" class="sref">unlikel[           ICMP7TCP R77> *f">nf/netfilter/nf_coignhasd"sref">tupe="k_core.c#L464" id="L464" class="line" name="L464"> 464        str7           w7ich c77ctrack 464<_hel de=c06" class="liL469"_hel oignhasd"sref">tupe="hel de=c06" class="hel oign" class="line" name="L464"> 464        str7    7      expectedepl_hash" class="sre+code=h" class="sref">aces i="netf">nf/netfilter/nf_conlaser/nf_conntrackash_="sref">aces i="netf"ash_="srefoign" class="line" name="L464"> 464        str7sref">cti7fo) != aces i="netf">nf/netfiltere/ namoignhasd"sref">tupe="e/ nam">aces i="netf"e/ namoign" class="line" name="L464"> 464        str7s       <780                re7urn <78>[tupe="ex" idre.c#L443" iex oign" class="line" name="L464"> 464        str7net;
 455}
 464        str7nf_78href="+code=N 464<_L443"> 443        s> 464<_L443"> onlass="sref">ct-f443"> lext"  lextoign" class="line" name="L464"> 464        str7 483        ct-f443"> ies
 ioign" class="line" name="L464"> 464        str778class="commen"f er/nf_conntrack_ccff_coinvert="sref">aces i="netf">nf/coinvert="srefet/netfilter/nf_conntrackash_="sref">aces i="netf"ash_="srefoignash_insert" classLs="sode=tuplehar8+cod8f="+c3>sh_insert" classl3protc#L479" id="L479l3protconla>sh_insert" classl4protc#L479" id="L479l4protconlao/likely" class="sref">unlikel[78t, aces i="netf"pr_debun" clnn4" cT442"tercodL506>"Cap.c#L5t invert od8f=.\n"href="n/"+code=tupleL26170         421IP_CT_DIR7REPLY78ctrack( 455}
         421/* We're7not i79="L509" class="line" name="L509k_confirm5/a>(struc7<"L480"> 7mment">           connec7ions 79ls_node<+code=ct" class="srek_core.c#L464" id="L464ref="net/netfilterf="netL453"> 45alloherinc> 442
f="netL453"> 45allohe="L5t/netfilter/nf_conntrack_core.c#L469" id,dt-> 06"> 506   Ls="sode=tuplehar8+cod8f="+c3>stfilter/nf_conntrackash_="sref">aces i="netf"ash_="srefoignash_insert" classGFP_ATOMI>out:
" id>kely" class="sref">unlikel[ 4917span class="comment">   7     79t;,  485         421o5e=repl7"comment">/* NF_CT_ASSER7(atom79href="+code=N_conntrack_core.c#LIS_ERsHELPEic#L446" iIS_ERslter/t/netfilter/nf__core.c#L443" id="L443"/=lass="sref">tuplehash[         421t /* 7o ext79er use of that particular connede=nf_ct_5uplehash_7<( 495           cf443"> lext"  lextoignref="net/netfilter&"L_"  lfine"  lfine" clnntrack_core.c#Lt"L_"  455}
         421n class=7med" class="sref">nf_ct_7s_con79    gotock_co_conntrack_core.c#Lt443"> lext"  lextoign=lass="sref">tuplehash[ct-f443"> ies
 ioignref="net/netfilterN="netTIMEOUetEXT_DATA55"> 455}
 lext"  lextoign="+code=tupleL26170         421a href="7et/netfilter/nf_conntrac7_core79/a>].         421(& ies
 ioignref="net/netfilterl4protc#L479" id="L479l4protconlar_each_entry( ies
 ie="L5t/netfilter/nf_conntrack_core.c#L469" id="+code=tupleL26170         421 421   8to ch80t; 442
ne" name="L461">dataoff">aces i="netf"dataoff" id,dt-> ies
 ioigno/likely" class="sref">unlikel[/* NF_CT_ASSER8ainst80_conn>(aces i="netf"nede=nf_ct_5ufreee="L5h_insert" class     if (         421    8      user context, else8we in80#L493" id="L4oto_ntrah_insert" classpr_debun">aces i="netf"pr_debun" clnn4" cT442"tercodL506>"">it ">NF_CT_5:Ecap.c#L5t _CT_5 with protc module\n"href="n/"+code=tupleL26170         421        8  fur80]lter/nf_conntrack_c+> de=DROPe=out" class=NUL455"> 455}
         421nf_c8_is_d80 class="sref">nf_conntrack_has5struct (& lext"  lextoign=lass="sref">tuplehash[ lext_ade"  lext_adelter/t/netfilter/nf__core.c#L443" id="L443"ash_insert" classt443"> lext"  lextoignname="L444"> 444L443"> 443        out:
" id)class="sref">tuplehash[out:
" id)class="sref">tuplehash[/* See if ther8'81> 451out:
" id)class="sref">tuplehash[           NAT could8have 81de=inlass="sref">tuplehash[    8 class="comment">       8   no81"comment">/* reuse the hash e/ nam">aces i="netf"e/ namoignref="net/netfilter&"L_"  455}
         4218ash.aces i="netf"e/ namoignr?t/nf_conntrack_ce/ nam">aces i="netf"e/ namoignr_each_entry( 465     8ORIGINAL"8class="sref">IP_CT_DIR_O8IGINA81/a>].aces i="netf"e/ namoignr?t/nf_conntrack_ce/ nam">aces i="netf"e/ namoignr_each_entry( 465     8Onf_ct_is8h" class="sref">h-&g8;, out:
" id)class="sref">tuplehash[nf_ct_tuple8ash_t81#L474 class="line" name="L464"> 464        str8O9_unlock818"> 518            8     81/a>].inrt_fabf="net/netfilters">inrt_fabfet/netfilter/nf_conntrackode=h" class=lt_fed);
tuplehash[repl_8ash de=repl_hash" class=ex" idre.c#L443" iex oignref="net/netfilter/nf_cofine=expek_atoe4" -> 06"> 506   Ls="sode=tuplehar8+cod8f="+c3)class="sref">tuplehash[tupl8hash<82ls_node<+code_conntrack_core.c#Lex" idre.c#L443" iex oign/likely" class="sref">unlikel[8-82tL443" id="L443" ntrack_core.c#L466"pr_debun">aces i="netf"pr_debun" clnn4" cT442"tercodL506>"">NF_CT_5:Eexpek_atoe4 arrives ct=.c#7;pEexp=.c#7;p\n"href="naet/netfilter/nf_conntrack5L469"> 465     8 ss="comm8et/n5tfilt52onn" class="8ref">82_conn>(tuplehash[    8e=nf5ct_zo52t" class="sr8f">nf82#L493" id="L4oto_ntra"4" cT442"ter/nfi"line" eWel/nfe, Mr. Bond. eWe.c#L5ve beenEexpek_namcyou..oea href="net/netfilter/nf_conntrack5L469"> 465     8T/a>stfilter/nf_conntrack_core.c#L443" id="L443"name="L444"> 444 clauies
tuplehash[IP_CT_DIR_OR8GINAL82/a>]. 444mast"L442"> 442
 444mast"L442"> 442
tuplehash[,  444hel "L442"> 442
unlikel[ 444hel 442"> 442
 444hel "L442"> 442
 465     8 9_unlock8et/n5tfilt5r/nf_cT could8have 82/a>].out:
" id)class="sref">tuplehash[ 442
tuplehash[h8ist_n83>[ 442
 442
 444hel "L442"> 442
 444hel "L442"> 442
tuplehash[/*5See if there&839;s 83tL443" id="L443" ntra href="+code=EEXIST" class5  struct 5a href="+8tuplehash[       8   no83rt an#ifdefsh_insert" classCONFIG_f="nONNTRACK_MARK442"> 442
tuplehash[        8  fur83]lter/nf_conntrack_c+="net/netfilter_core.c#L443" id="L443"name="L444"> 444marfed);
 444mast"L442"> 442
 444marfed);
tuplehash[nf_ct_tuple8_core83class#endifhref="+code=EEXIST" class5  struct 5a href="+8onf_ct_is836">5436            8     8     g#ifdefsh_insert" classCONFIG_f="nONNTRACK_SECMARK442"> 442
tuplehash[repl_8, (ct-_core.c#L443" id="L443"name="L444"> 444 ecmarfed);
 444mast"L442"> 442
 444 ecmarfed);
tuplehash[IP_CT_DI8_REPL8h-&g8; 444mast"L442"> 442
 444nf_     )class="sref">tuplehash[e="L5t/netfilter/nf_conntrack_core.c#L469" id,dt->{
)class="sref">tuplehash[54418-84> 451unlikel[ 442
th_insert" classGFP_ATOMI>out:
" id)class="sref">tuplehash[e="L5t/netfilter/nf_conntrack_core.c#L469" id,dt->{
tuplehash[/* 8o ext84./* ip8_REJE84ter/nf_conntrack_core.c#L518" i_">NF_CT_5L((  ss=listoea href="net/netfilter/nf_conntrack5L469"> 465     8an_unlock8bh(&am54           w8ich c84ctrack( 444hlist_nulls_ade_head_rcu442"> 442
 444Ls="sref"ore.c#L443" id=Ls="sref"443"n, &h, ct 465     8hlist_nulls_for_each_entry(h,   ssef="+code=h" clun o  sslter)class="sref">tuplehash[h8ist_n85ls_node<+code=ct" class="sres">inunrt_fabf="net/netfilters">inunrt_fabfet/netfilter/nf_conntrackode=h" class=lt_fed);
tuplehash[ 451lass="sref">tuplehash[, unlikel[(&am5; 444expek_f4" tuplehash[8ash 444expek_f4" tuplehash[].tuplehash[nf_ct_tuple8ash_t85#L474 class="line" name="L464"> 464        str8ia href="8ass=5comme55/nf_conntrac8_core85/a>]. de=DRtfilter/nf_conntrack_core.c#L443" id="L443"name="L444"> 444Ls="sref"ore.c#L443" id=Ls="sref"443"n, &tuplehash[ 421 de=Ds ">NF_CT_5 ptr, ssss skbname=nfct and k_nafoea href="net/netfilter/nf_conntrack5L469"> 465     8 a href="8hash5 clas56et, ].f">nf/netfilter/nf_coignhaet/netfilter/nf_conntrack5L469"> 465     8 n_unlock8h" c5ass="5ref">nf_connt8_core86ef="+OPe=out" class=resolve_normal__core.c#L443" id=resolve_normal__coign/ctinfo;
f">nf/netfilter/nf_coignhasd"sref">tupe="tmh_" kely" class="sref">unlikel[aces i="netf"sk_buffonlass="sref">ct-skb442"> 442
kely" class="sref">unlikel[].dataoff">aces i="netf"dataoff" id,kely" class="sref">unlikel[h, ,ef">h, unlikel[(h, ,ef">h, unlikel[].ct-l3protc#L479" id="L479l3protconla>kely" class="sref">unlikel[ct-l4protc#L479" id="L479l4protconla>kely" class="sref">unlikel[ct-set_ash_5"> 505
kely" class="sref">unlikel[8-87t;,    enume, &ct-k_nafoore.c#L443" id="Lnafoonla=lass="sref">tuplehash[f">87_connikely" class="sref">unlikel[nf87#L493" id="L4epl_hash" class="sre+code=h" class="sref">aces i="netf">nf/netfilter/nf_conlaser/nf_conntrackLs="sode=tuplehar8+cod8f="+c3class="sref">tuplehash[h, tuplehash[/* ip8_REJE876lter/nf_connf">nf/netfilter/nf_coignhasd"sref">tupe="     if (         421           ICMP8TCP R87> *h, net;
 455< 464        str8           w8ich c87ctrack( 444"omme5t">/*5">net 485         464        str8    87/, tuplehash[cti8fo) != aces i="netf">nf/coget_fsref" clnntrack_core.c#Lskb442"> 442
ne" name="L461">skb_plework_offsss="sref">hlist_nskb_plework_offsss" clnntrack_core.c#Lskb442"> 442
kely" class="sref">unlikel[                re8urn <88>[dataoff">aces i="netf"dataoff" id,,ef">h, h, sh_insert" classl3protc#L479" id="L479l3protconla>kely" class="sref">unlikel[, ct-l4protc#L479" id="L479l4protconlao/likely" class="sref">unlikel[nf_88_conn>(aces i="netf"pr_debun" clnn4" cT442"tercodL506>"resolve_normal__c: Cap.c#L5t get od8f=\n"href="n/"+code=tupleL26170         421 483         455}
         42188ter/nf_conntrack_core.c#L518" i_">NF_CT_5L(88    gotock_cor4" cT442"ter/nfi"line"  look for od8f= matchea href="net/netfilter/nf_conntrack5L469"> 465     8_DIR_REPL8" class="sref">IP_CT_DIR8REPLY88ctrack( 444h85"> 485         465{
 465sh_insert" classlter/nf_conntrack_core.c#L4/"+code=tupleL26170         421 45fine=gonntrack_core.c#Lf="netL453"> 45fine=gone="L5t/netfilter/nf_conntrack_core.c#L469" id,dt-> tfilter/nf_conntrackLs="sode=tuplehar8+cod8f="+c3>sh_insert" class485"> 485         421/* We're8not i89], unlikel[ 8mment">           connec8ions 89>[itt469"> 465" itt469"> 465e="L5t/netfilter/nf_conntrack_core.c#L469" id,dt->ttfilter/nf_conntrackLs="sode=tuplehar8+cod8f="+c3>sh_insert" classl3protc#L479" id="L479l3protconla>"="sref">ct-l4protc#L479" id="L479l4protconla>kely" class="sref">unlikel[ 4918span class="comment">   8     89t;,  442
ne" name="L461">dataoff">aces i="netf"dataoff" id,dt-> 485         421/* NF_CT_ASSER8(atom89_conn>(         421 455}
         421t /* 8o ext89]lter/nf_conntrack_c+_conntrack_core.c#LIS_ERsHELPEic#L446" iIS_ERslter/t/netfilter/nf_rcode=ct" class=""+c3//+code=tupleL26170         421 495].tuplehash[nf_ct_8s_con897/a>. 444k_core.c#L464" id="L464ref="net/netfilter"nett_ts="sref"_toett 465" tuplehash[tuplehash[ 465     9 455<unlikel[   9to ch90t;, ct-k_nafoore.c#L443" id="Lnafoonlaref="net/netfilterIP"netESTABLISHED_REPLYore.c#L443" id=IP"netESTABLISHED_REPLY"+c3class="sref">tuplehash[/* NF_CT_ASSER9ainst90_conn>( 465     9<4ct-set_ash_5"> 505
tuplehash[/* 9  fur90]lter/nf_conn}=elselikely" class="sref">unlikel[ 465     9<7 href="9eed" class="sref">nf_ct_9_is_d90t, ttfilter/nf_conntrack_core.c#L443" id="L443"name="L444"> 444 clauies
unlikel[ 444pr_debun">aces i="netf"pr_debun" clnn4" cT442"tercodL506>"el[ 444k_core.c#L464" id="L464/class="sref">tuplehash[, ct-k_nafoore.c#L443" id="Lnafoonlaref="net/netfilterIP"netESTABLISHEDore.c#L443" id=IP"netESTABLISHED"+c3class="sref">tuplehash[stfilter/nf_conntrack_core.c#L443" id="L443"name="L444"> 444 clauies
unlikel[ 444pr_debun">aces i="netf"pr_debun" clnn4" cT442"tercodL506>"el[unlikel[/* See if ther9'91t;,  444k_core.c#L464" id="L464/class="sref">tuplehash[           NAT could9have 91_conn>(ct-k_nafoore.c#L443" id="Lnafoonlaref="net/netfilterIP"netRELATEDore.c#L443" id=IP"netRELATED"+c3class="sref">tuplehash[       9   no91#L493" id="L4oto_ntra}=elselikely" class="sref">unlikel[9ashaces i="netf"pr_debun" clnn4" cT442"tercodL506>"el[ 444k_core.c#L464" id="L464/class="sref">tuplehash[IP_CT_DIR_O9IGINA91/a>].ct-k_nafoore.c#L443" id="Lnafoonlaref="net/netfilterIP"netNEWore.c#L443" id=IP"netNEW"+c3class="sref">tuplehash[h-&g9;, nf_ct_tuple9ash_t91ctrack(ct-set_ash_5"> 505
tuplehash[ 518            9     91/a>].repl_9ash de=repl_hash" class=skb442"> 442
( 444nf_     class="sref">tuplehash[tupl9hash<92ls_node<+code=ct" class="sreskb442"> 442
(ct-k_nafoore.c#L443" id="Lnafoonlaclass="sref">tuplehash[9-92tL443" id="L4> de=DROPe=out" class=     if (         42192_conn href="+code=EEXIST" class5  struct 5a href="+9c4nf92#L493href="+code=EEXIST" class5  struct 5a href="+9c/a>IP_CT_DIR_OR9GINAL92/a>].="net/netfilter"neta href=5+in" ctinfo;
,ef">h, aces i="netf"pf" id,d1" class="line" name="L461">hooknumntrack_core.c#Lhooknumonla>kely" class="sref">unlikel[, aces i="netf"sk_buffonlass="sref">ct-skb442"> 442
         421unlikel[ct-_core.c#L443" id="L443"asasd"sref">tupe="tmh_"  455}
         421(&am53/* We're9not i93], ct-k_nafoore.c#L443" id="Lnafoonlaclass="sref">tuplehash[h9ist_n93>[ct-l3protc#L479" id="L479l3protconlaclass="sref">tuplehash[/*5See if there&939;s 93tL443" id="L4epl_hash" class="sre+code=h" class=l4protc#L479" id="L479ode=h" class=l4protconlass="sref">ct-l4protc#L479" id="L479l4protconlaclass="sref">tuplehash[ 464<_L443"> 443        s> 464<_L443"> onlass="sref">ct-f443"> lext"  lextoign" class="line" name="L464"> 464        str9       9   no93#L493" id="L41" class="lins="sref">ct-f443"> ies
 ioign" class="line" name="L464"> 464        str9        9  fur93]lter/nf_conn1" class="line" name="L461">dataoff">aces i="netf"dataoff" id" class="line" name="L464"> 464        str9nf_ct_tuple9_core93class="comment">           cu_"li8_nntrack_core.c#Lu_"li8_n,ef">h,  464        str95436            9     93    gotock_co_line" name="L461">set_ash_5"> 505
tuplehash[repl_9, (ronntrack_core.c#Lretoign" class="line" name="L464"> 464        str9<9_unlock9Y" c5ass="5ref">IP_CT_DI9_REPL93/, tuplehash[h-&g9; 442
(unlikel[[ 465     9e 54419-94t;, tupe="tmh_"  442
( 464        str9aces i="netf">nf/cois_temh_atflter/t/netfilter/nf_t"L_" unlikel[tupe="f="netSTAT_IN>_ATOMI>out:
tuplehash[/* 9o ext94]lter/nf_conntrack_c+de<+code> de=DROPe=out" class=NF_ACCEPTHELPEic#L446" iNF_ACCEPTL464" class="line" name="L464"> 464        str9/* ip9_REJE94/a>].,  442
( 455}
         421(&am54           w9ich c94ctrack(tuplehash[[ 465     9h9ist_n95ls_node<+code=ct" class="srel3protc#L479" id="L479l3protconlaref="net/netfilterf="nett=l3protc_fine" aces i="netf"pf" id/class="sref">tuplehash[ 451 442
ne" name="L461">skb_plework_offsss="sref">hlist_nskb_plework_offsss" clnntrack_core.c#Lskb442"> 442
kely" class="sref">unlikel[, aces i="netf"dataoff" id,dtfilter/nf_conntrackprotcnumntrack_core.c#Lprotcnum" id/class="sref">tuplehash[(&am5;unlikel[9ashaces i="netf"pr_debun" clnn4" cT442"tercodL506>"eot pasharss=to _CT_5 yet ornerrornoccurrss\n"href="n/"+code=tupleL26170         421_ATOMI>out:
tuplehash[_ATOMI>out:
tuplehash[ct-ronntrack_core.c#Lretoignref-e" name="L461">ronntrack_core.c#Lretoign" class="line" name="L464"> 464        str9ia href="9ass=5comme55/nf_conntrac9_core95/a>].ct-"> 443        "> onla" class="line" name="L464"> 464        str9href="net9netf5lter/56rack_core.c#9509" 96],  421aces i="netf"pf" id,,ef">h, tuplehash[, tuplehash[nf_connt9_core96"comment">/* r4" cT442"ter/nfi"line"  It may be  cTspecial p="+ss,nerror,d1"clean...href="net/netfilter/nf_conntrack5L469"> 465     9ct  465     9c="+code=9n_he5p" cl56nf_conntrack9core.96/a>].r4" cT442"ter/nfi"line="+code=t* /a>  what=_codo with _heep="+ss=ea href="net/netfilter/nf_conntrack5L469"> 465     9 ( 444errorntrack_core.c#Lerror" id !ef="net/netfilterNUL455"> 455}
unlikel[( 444errorntrack_core.c#Lerror" id5t/netfilter/nf_conntrack_core.c#L469" id,dt->tt/netfilter/nf_skb442"> 442
ne" name="L461">dataoff">aces i="netf"dataoff" id,dtfilter/nf_conntrackk_nafoore.c#L443" id="Lnafoonla>kely" class="sref">unlikel[].aces i="netf"pf" id,,ef">h, tuplehash[unlikel[_ATOMI>out:
tuplehash[9-97t;,    ppppppt/netfilter/nf_f="netSTAT_IN>_ATOMI>out:
tuplehash[f">97_conn>(ct-ronntrack_core.c#Lretoignref-e" name="L461">ronntrack_core.c#Lretoign" class="line" name="L464"> 464        str9 n_unlock9ode=nf_ct_net" class="sr9f">nf97#L493" id="L4oto_ntrast/a>, ct-"> 443        "> onla" class="line" name="L464"> 464        str9 t /* ip9_REJE97/a>].NF_CT_5=ea href="net/netfilter/nf_conntrack5L469"> 465     9an class=9comment">           ICMP9TCP R97t,  442
( 465     9aa href="9s="comment">           w9ich c97ctrack(ct-"> 443        "> onla" class="line" name="L464"> 464        str9 a href="9cti9fo) != ->tt/netfilter/nf_skb442"> 442
ne" name="L461">dataoff">aces i="netf"dataoff" id,dt/netfilter/nf_pf">aces i="netf"pf" id,,ef">h, kely" class="sref">unlikel[, ct-l4protc#L479" id="L479l4protconla>dtfilter/nf_conntrackset_ash_5"> 505
dtfilter/nf_conntrackk_nafoore.c#L443" id="Lnafoonla/class="sref">tuplehash[nf_98href="+code=N_conr/nf_conntrack_ck_core.c#L464" id="L464/likely" class="sref">unlikel[ 483        NFe"Lnonea href="net/netfilter/nf_conntrack5L469"> 465     9_ATOMI>out:
tuplehash[98/a>]. 464        str9=n class=9href="+code=net" class="9ref">98t, ct-"> 443        "> onla" class="line" name="L464"> 464        str9_DIR_REPL9" class="sref">IP_CT_DIR9REPLY98ctrack(tuplehash[/* We're9not i99], ct-IS_ERsHELPEic#L446" iIS_ERslter/t/netfilter/nf_k_core.c#L464" id="L464//likely" class="sref">unlikel[ 9mment">           connec9ions 99>[ 465     9> 4919span class="comment">   9     99t;, <=ct" class="sref="netSTAT_IN>_ATOMI>out:
tuplehash[/* NF_CT_ASSER9(atom99_conn>(:
 464        str9ct-"> 443        "> onla" class="line" name="L464"> 464        str9>t /* 9o ext99. 495NF_CT_5L(n class=9med" class="sref">nf_ct_9s_con99> *h,  442
( 464        str9>DIR_REPL9nfirming conntrack %9\n&qu99#L474 class="line" name="L464"> 464        str9>a href="9et/netfilter/nf_conntrac9_core99/a>].  policyEf="want=_coaph_5 to _his flow=ea href="net/netfilter/nf_conntrack5L469"> 465     10spin_lock10spinetfilter/nf_conntrac10spi>10sp *h,  lext"  lextoignref="net/netfilter"nett_t443"> lfine"  lfinelter/t/netfilter/nf_k_core.c#L464" id="L464/" c/pre>t/netfilter/nf_conntrack5L469"> 465     10s1in_lock10sment">           connec10sme>10sls_node<+code_conntrack_core.c#Lf443"> lext"  lextoign/et/netfilter/nf_conntrack5L469"> 465     10s2in_lock10span class="comment">   10spa>10st;, tupe="t443"> ies
 ioignref="net/netfilterNF_netTIMEOUT_EXT_DATAHELPEic#L446" iNF_netTIMEOUT_EXT_DATAlter/t/netfilter/nf_f443"> lext"  lextoign/" class="line" name="L464"> 464        str10s3in_lock10scomment">/* NF_CT_ASSER10sco>10s_conn>( 464        str10s4in_lock10st/netfilter/nf_conntrac10st/>10s#L493" id="L4oto_ntrah_insert" classt443"> ies
 ioignref="net/netfilterl4protc#L479" id="L479l4protconlaname="L444"> 444get_f443"> ies
 ilter/t/netfilter/nf_conntrack_core.c#L469" id/" class="line" name="L464"> 464        str10s5in_lock10span class="comment">/* 10spa>10s5L474 class="line" name="L464"> 464        str10s6in_lock10sine" name="L495"> 49510sclass="comment">           cronntrack_core.c#Lretoignref="net/netfilterl4protc#L479" id="L479l4protconlaname="L444"> 444p="+ssntrack_core.c#Lp="+sslter/t/netfilter/nf_k_core.c#L464" id="L464>tt/netfilter/nf_skb442"> 442
ne" name="L461">dataoff">aces i="netf"dataoff" id,dt/netfilter/nf_k_nafoore.c#L443" id="Lnafoonla>pt/netfilter/nf_pf">aces i="netf"pf" id,,ef">h, -> ies
 ioign/" class="line" name="L464"> 464        str10s7in_lock10sed" class="sref">nf_ct_10sed>10st, unlikel[10sctrack( de=DR  465     10s9in_lock10st/netfilter/nf_conntrac10st/>10s9a>].r4" cT442"ter/nfi"line="+code=ttttttttt* _heef_conntra /a>  what=_codo a href="net/netfilter/nf_conntrack5L469"> 465     101pin_lock10ter/nf_conntrack_core.c#10ter>10teL493" id="L4oto_ntrah_insert" classpr_debun">aces i="netf"pr_debun" clnn4" cT442"tercodL506>"el[         42110t>[ 443        s> 4  " clnntrack_core.c#Lskb442"> 442
( 464        str10t2in_lock10"comment">/* See if ther10"co>10tt;, tupe="skb442"> 442
( 455}
         421           NAT could10nt">10t_conn>(_ATOMI>out:
tuplehash[       10 cl>10t#L493" id="L4oto_ntra"f epl_hash" class=ronntrack_core.c#Lretoignr=ef-e" name="L461">NF_DROPout:
 465     1015in_lock10code=hash" class="sref">10cod>10t]lter/nf_conntrack_c+de<+code=ct" class="sref="netSTAT_IN>_ATOMI>out:
tuplehash[IP_CT_DIR_O10cla>10t/a>].ronntrack_core.c#Lretoign" class="line" name="L464"> 464        str10t7in_lock10h" class="sref">h-&g10h" >10tt, ct-"> 443        "> onla" class="line" name="L464"> 464        str10t8in_lock10class="sref">nf_ct_tuple10cla>10tctrack( 518            1018">10t/, tuplehash[repl_10has>10ha,  505
ttfilter/nf_conntrack_core.c#L443" id="L443"name="L444"> 444 clauies
tuplehash[tupl10eha>10h>[aces i="netf">nf/ tuplehash[10 hr>10ht;ct-"> 443        "> onla: css="sref">tuplehash[->unlikel[ 465     1025in_lock10href5"+cod52/nf_conntrac10hre>10h]lterr4" cT442"ter/nfi"line="+code=ttttttttt* _emh_atf again to _his p="+ss=eWe ailume that=_his p="+ssltef="net/netfilter/nf_conntrack5L469"> 465     1026in_lock10lass5"sref5>IP_CT_DIR_OR10las>10h/a>].r4" cT442"ter/nfi"line="+code=ttttttttt* has no ">NF_CT_5 ailigned. This is usss=by >[ 465     1027in_lock10href5"+cod52k_hash_check10hre>10ht,  465     1028in_lock10" cl5ss="s528nf_conntrac10" c>10hctrack( 444skb442"> 442
(aces i="netf">nf/ tuplehash[ 464        str103pin_lock10bh(&am53/* We're10bh<>10bhtrack( 444>[ 443        s> 4t"p> " clnntrack_core.c#Ltmh_" tuplehash[h10et/>10b1track(/*5See if there&10omm>10b2, tuplehash[10bhref="+code=N> de=DROPe=out" class=ronntrack_core.c#Lretoign" class="line" name="L464"> 464        str1034in_lock10clas5="sre53ent">       10cla>10b#L493 href="+code=EEXIST" class5  struct 5a href="+1035in_lock10h" c5ass="53nt">        10h" >10b5;ct-EXPORetSYMBOL_GP455"> 455}
aces i="netf">nf/ tuplehash[nf_ct_tuple10cla>10bter/nf_conntrack_core.c#L518" i_">NF_CT_5L(5436            1036">10b7;ct-boo_"  444>[[aces i="netf">nf/h" class=fsrefL464rst/netfilter/nf_inverse" NF_CT_5L(repl_10has>10bctrack(Nst4epl_hash" class="sre+code=h" class=fsref">aces i="netf">nf/h" class=fsrefL464rst/netfilter/nf_orin">aces i="netf"orinonla/et/netfilter/nf_conntrack5L469"> 465     1039in_lock10Y" c5ass="5ref">IP_CT_DI10Y" >10b/a>].ikely" class="sref">unlikel[h-&g10h" >10h"lass="comment">           cboo_"  444ronntrack_core.c#Lretoign" class="line" name="L464"> 464        str1041in_lock10clas5="sre54          re10cla>10hls_no+code=tupleL26170         42154411041">10h> 451tuplehash[[[ct-"rin">aces i="netf"orinonla,f_conntrack_core.c#L518" i_">NF_CT_5L(10h#L493" id="L4oto_ntrast/a>, <+code=h" "L444"> 444f="nett=l3protc_fine" aces i="netf"orinonlaname="L444"> 444 rc442"> 442
NF_CT_5L(/* 10" c>10h]lter/nf_conntrack_c+de<+code+code=h" "L444"> 444f="nett=l4protc_fine" aces i="netf"orinonlaname="L444"> 444 rc442"> 442
NF_CT_5L(/* ip10ash>10h/a>]. 444"rin">aces i="netf"orinonlaname="L444"> 444dsnntrack_core.c#Ldsnonla.="net/netfilterprotcnumntrack_core.c#Lprotcnum" id//" css="sref">tuplehash[10h> *h, tuplehash[ 464        str1049in_lock10et/n5tfilt54            10et/>10h9L493 href="+code=EEXIST" class5  struct 5a href="+105pin_lock10onnt5ack_c55e=net" class10onn>10on;ct-EXPORetSYMBOL_GP455"> 455}
tuplehash[h10et/>10ols_no+code=tupleL26170         421 465     1053in_lock10ass=5sref"5net, 10o3a>].r4" cT442"ter/nfi"line="+implicit_5  46y: see f="net69"> 465 465     1054in_lock10bh(&am5; 505
 505
 465     1055in_lock10ame=5L454"55lass="sref">10ame>10o]lter/nf_conntrack_c+de<+code+code=">Nst4epl_hash" class="sre+code=h" class=fsref">aces i="netf">nf/h" class=fsrefL464rst/netfilter/nf_newash_5"> 505
 465     1056in_lock10t/ne5filte5/nf_coref="ne10t/n>10o6a>].ikely" class="sref">unlikel[10o> * 464<_help">aces i="netf">nf/h" _helpL464rst/netfilter/nf_help">aces i="netf"helpL464ref="net/netfilter>[tt_help">aces i="netf">ntt_helplter/t/netfilter/nf_k_core.c#L464" id="L464/" css="sref">tuplehash[ 464        str10o9in_lock10ass=5comme55/nf_conntrac10ass>10o/a>]. 465     106pin_lock10netf5lter/56rack_core.c#10net>10ne *h, [tuplehash[ 42110n> 451aces i="netf"pr_debun" clnn4" cT442"tercodL506>"AntraL50 ash_5 ts="s of .c#7;p to "href="naa"L444"> 444k_core.c#L464" id="L464/class="sref">tuplehash[[[ 505
tuplehash[nf_connt10h" >10n#L493href="+code=EEXIST" class5  struct 5a href="+10n5in_lock10="+c5de=nf56454     10="+>10n5 451 444ts="shash" ct-cowash_5"> 505
tuplehash[10n/a>]. 444mash].<|| e="net/netfilterhelp">aces i="netf"helpL464rtfilttfilt r/nf_conntrack_chlist_empt5"> 505
aces i="netf"helpL464name="L444"> 444expectaLnonies
 465     1067in_lock10" cl5ss="s56k_hash_check10" c>10nt, tuplehash[10n#L474 class="line" name="L464"> 464        str1069in_lock10clas5="sre56/nf_cT could10cla>10n9 451tuplehash[10a  451 444NUL455"> 455}
 444GFP_ATOMI>out:
onla/class="sref">tuplehash[10als_node<+code=ct" class="srercu_read_unlt_fntrack_core.c#Lrcu_read_unlt_flter//" css="sref">tuplehash[10et/>10a2L493 href="+code=EEXIST" class5  struct 5a href="+1073in_lock10hash"+code=h" class="sre10has>10a3;ct-EXPORetSYMBOL_GP455"> 455}
 505
tuplehash[NF_CT_5 for _his many jiffies and do accountL50 "f do_acct is 1 a href="net/netfilter/nf_conntrack5L469"> 465     1076in_lock10an class="comment">/* ip10an >10a6L493voidlh" class="sre+cf="nett=refresh_acct"  505
 465     1077in_lock10comment">           ICMP10com>10at, ct-k_nafoore.c#L443" id="Lnafoonla>et/netfilter/nf_conntrack5L469"> 465     1078in_lock10s="comment">           w10s=">10actrack(Nst4epl_hash" class="sre+csk_buff">aces i="netf"sk_buffonlass="sref">ct-skb442"> 442
et/netfilter/nf_conntrack5L469"> 465     1079in_lock10 444ex> 4_jiffieses
 465     108pin_lock10fo) != do_acct"  465     1081in_lock1080                re1080<>10f1a>].ikely" class="sref">unlikel[10f> 451 444t443"> 443        L443"> onla.="net/netfilterdata" tuplehash[ 442
tuplehash[ 483        10f#L493href="+code=EEXIST" class5  struct 5a href="+1085in_lock10code=hnnode" class="sref10cod>10f5 451  a href="net/netfilter/nf_conntrack5L469"> 465     1086in_lock10ref="+code=hash" class="10ref>10f/a>]. 444 clauies
tuplehash[ct-acct" tuplehash[IP_CT_DIR10" c>10f#L474 class="line" name="L464"> 464        str1089in_lock10et/netfilter/nf_conntrac10et/>10f/a>]. 465     109pin_lock10s="comment">/* We're10s=">10s=a>].unlikel[           connec10mme>10s>[ 444t443"> 443        L443"> onla.="net/netfilterexpireses
 4_jiffieses
tuplehash[   10spa>10s> 451unlikel[/* NF_CT_ASSER10"co>10s_conn>( 444newL443"> 505
 4_jiffiesonlaclass="sref">tuplehash[/* 10spa>10s]lter/nf_conntrack_c+=4" cT442"ter/nfi"line"  Only updatf _heet443">  if _heef_wet443">  is at leassltef="net/netfilter/nf_conntrack5L469"> 465     1096in_lock10line" name="L495"> 49510s/a>].r4" cT442"ter/nfi"line="+code=ttttttttt  HZ jiffies from _heeols=t443"> . Ness=del_t443r for  46fltef="net/netfilter/nf_conntrack5L469"> 465     1097in_lock10med" class="sref">nf_ct_10med>10s7a>].r4" cT442"ter/nfi"line="+code=ttttttttt  avoidancs (may already be dyi50)=ea href="net/netfilter/nf_conntrack5L469"> 465     1098in_lock10nfirming conntrack %10nfi>10sctrack( 505
 444t443"> 443        L443"> onla.="net/netfilterexpireses
 465     1099in_lock10et/netfilter/nf_conntrac10et/>10s/a>]. 444mod_t443r_pendL506re.c#L443" id=mod_t443r_pendL50lter/tfilter/nf_conntrack_core.c#L443" id="L443"name="L444"> 444t443"> 443        L443"> onlaaa"L444"> 444newL443"> 505
tuplehash[           connec11sme>110ls_no+code=tupleL26170         421   11spa>110t;ct-acct" tuplehash[/* NF_CT_ASSER11sco>110href="+code=N_cont->unlikel[11s#L493" id="L4oto_ntra 464<_counter"  464<_counteronlass="sref">ct-acct" tuplehash[/* 11spa>11s5L474 class="line" name="L464"> 464        str11s6in_lock11sine" name="L495"> 495110/a>].tuplehash[nf_ct_11sed>110t, unlikel[11sctrack( 442
tuplehash[ 444atomic64_ade"  442
 444le "> 505
tuplehash[/* See if ther11"co>1112L493 href="+code=EEXIST" class5  struct 5a href="+11t3in_lock11nt">           NAT could11nt">1113;ct-EXPORetSYMBOL_GP455"> 455}
tuplehash[       11 cl>111#L493href="+code=EEXIST" class5  struct 5a href="+1115in_lock11code=hash" class="sref">11cod>1115;ct-boo_"  444f="nett=kill_acct"  505
 465     11t6in_lock11class="sref">IP_CT_DIR_O11cla>11t/a>].ct-k_nafoore.c#L443" id="Lnafoonla>et/netfilter/nf_conntrack5L469"> 465     11t7in_lock11h" class="sref">h-&g11h" >11tt, Nst4epl_hash" class="sre+csk_buff">aces i="netf"sk_buffonlass="sref">ct-skb442"> 442
et/netfilter/nf_conntrack5L469"> 465     11t8in_lock11class="sref">nf_ct_tuple11cla>111ctrack(do_acct"  465     11t9in_lock1118"> 518            1118">111/a>].ikely" class="sref">unlikel[repl_11has>11ha, unlikel[tupl11eha>11h>[ 464<_counter"  464<_counteronlass="sref">ct-acct" tuplehash[11 hr>1122, tuplehash[tuplehash[unlikel[112]lter/nf_conntrack_c+de<+code=ct" class="sreatomic64_inc442"> 442
"sref">unlikel[IP_CT_DIR_OR11las>112/a>]. 444atomic64_ade"  442
 444le "> 505
 442
et/netfilter/nf_conntrack5L469"> 465     1127in_lock11href5"+cod52k_hash_check11hre>11ht, tuplehash[11hctrack(h11et/>113ls_node<+code_conntrack_core.c#Ldel_t443r"  444t443"> 443        L443"> onla//likely" class="sref">unlikel[/*5See if there&11omm>113t;, tupe="_core.c#L443" id="L443"name="L444"> 444t443"> 443        L443"> onla.="net/netfilterfun"Lnon443        fun"Lnonlter/(1" class=lo50)/nf_conntrack_ck_core.c#L464" id="L464/class="sref">tuplehash[113_conn>(tuplehash[       11cla>1134a>].        11h" >113]lter/nf_conn> de=DROPe=out" class=false" tuplehash[nf_ct_tuple11cla>11bter/n href="+code=EEXIST" class5  struct 5a href="+1137in_lock1136">5436            1136">11b7;ct-EXPORetSYMBOL_GP455"> 455}
tuplehash[repl_11has>113#L474 class="line" name="L464"> 464        str1139in_lock11Y" c5ass="5ref">IP_CT_DI11Y" >11b/a>].#ifdefROPe=out" class=CONFIG_NF_nONNTRACK_ZONESHELPEic#L446" iCONFIG_NF_nONNTRACK_ZONESL474 class="line" name="L464"> 464        str114pin_lock11h" c5ass="5ref">h-&g11h" >11h"lass claicC 4 lext_typsntrack_core.c#L>[ct->[ 444f=read_most_5"> 505
unlikel[114ls_node<+code.="net/netfilterle "> 505
et/netfilter/nf_conntrack5L469"> 465     11h2in_lock1141">54411141">11h> 451 505
et/netfilter/nf_conntrack5L469"> 465     11h3in_lock11et/n5tfilt5r/nf_conntrac11et/>11h3 451et/netfilter/nf_conntrack5L469"> 465     1144in_lock11ode=5t" cl54/nf_conntrac11ode>11h#L493}class="sref">tuplehash[/* 11" c>11h]lter#endLflass="sref">tuplehash[/* ip11ash>114ter/nf_conntrack_core.c#L518" i_">NF_CT_5L(11h> * 465     1148in_lock11bh(&am54           w11bh<>114#L474 class="line" name="L464"> 464        str1149in_lock11et/n5tfilt54            11et/>114/a>].#includer<class="liinclude/4  ux name="L464">nam4  k.h" nam4  k.ha>].ame= class="line" name="L464"> 464        str115pin_lock11onnt5ack_c55e=net" class11onn>11on;nam4  k 464  .h" nam4  k 464  .ha>].ame= class="line" name="L464"> 464        str1151in_lock11et/n5tfilt55ass="sref">h11et/>11ols_no#includer<class="liinclude/4  ux mutex.h" ].ame= class="line" name="L464"> 464        str1152in_lock11="L451" cl55            11="L>1152, tuplehash[, 11o3a>].r4" cT442"ter/nfi"line/* GenericCfun"Lnon for _cp/udp/sctp/dccp and alcke. This needs to bfltef="net/netfilter/nf_conntrack5L469"> 465     1154in_lock11bh(&am5; , sincs we dop.c#L5t want=_he protccols to autoloadltef="net/netfilter/nf_conntrack5L469"> 465     1155in_lock11ame=5L454"55lass="sref">11ame>115]lterr4" cT442"ter/nfi"line=* or depend on ctnam4  kea href="net/netfilter/nf_conntrack5L469"> 465     1156in_lock11t/ne5filte5/nf_coref="ne11t/n>11o6a>]."line" name="L461">"nett_port_ts="s_to_nlattrntrack_core.c#L>[aces i="netf"sk_buffonlass="sref">ct-skb442"> 442
et/netfilter/nf_conntrack5L469"> 465     1157in_lock11=nf_5onntr55            11=nf>115t, Nst4epl_hash" class="sre+ck5L469"> 465aces i="netf">nf/h" class=fsrefL464rst/netfilter/nf_ts="sntrack_core.c#LfsrefL464/et/netfilter/nf_conntrack5L469"> 465     1158in_lock11et/n5tfilt55>nf_ct_tuple11et/>11o#L474ikely" class="sref">unlikel[11o/a>]. _beclass="sref"netf">la"p> _becl" clnntrack_core.c#Lskb442"> 442
 444CTA_PROTO_SRC_POReHELPEic#L446" iCTA_PROTO_SRC_POReonlaaa"L444"> 444ts="sntrack_core.c#LfsrefL464name="L444"> 444 rc442"> 442
 442
unlikel[116eL493" id="L4oto_="net/netfilternla"p> _beclass="sref"netf">la"p> _becl" clnntrack_core.c#Lskb442"> 442
 444CTA_PROTO_DST_POReHELPEic#L446" iCTA_PROTO_DST_POReonlaaa"L444"> 444ts="sntrack_core.c#LfsrefL464name="L444"> 444dsnntrack_core.c#Ldsnonla.="net/netfilteru442"> 442
 465     1161in_lock11+cod5=sk_b56/nf_conntrac11+co>116>[ct->la"p> _failurf">aces i="netf">la"p> _failurfonlaclass="sref">tuplehash[11n> 451 de=DR0class="sref">tuplehash[tuplehash[nf_connt11h" >11n#L493="sref">ct->la"p> _failurf">aces i="netf">la"p> _failurfonla: css="sref">tuplehash[     11="+>116]lter/nf_conn> de=DR-1class="sref">tuplehash[116ter/n href="+code=EEXIST" class5  struct 5a href="+1167in_lock11" cl5ss="s56k_hash_check11" c>1167;ct-EXPORetSYMBOL_GP455"> 455}
tuplehash[11n#L474 class="line" name="L464"> 464        str1169in_lock11clas5="sre56/nf_cT could11cla>11n9 451">Nst4epl_hash" class="sre+ckla"polic5"> 505
ct->[ 505
unlikel[et/netfilter/nf_conntrack5L469"> 465     1171in_lock11 hre5="+co57/nf_conntrac11 hr>11als_node<+code[t/netfilter/nf_CTA_PROTO_DST_POReHELPEic#L446" iCTA_PROTO_DST_POReonla]>et/netfilter/nf_conntrack5L469"> 465     1172in_lock11et/n5tfilt57lass="sref">11et/>11a2L493 class="sref">tuplehash[ct-EXPORetSYMBOL_GP455"> 455}
 505
tuplehash["nett_port_nlattr_to_ts="sntrack_core.c#L>[ 442
et/netfilter/nf_conntrack5L469"> 465     1176in_lock11an class="comment">/* ip11an >117/a>]. 465aces i="netf">nf/h" class=fsrefL464rst/netfilter/nf_t442"> 442
 465     1177in_lock11comment">           ICMP11com>11atikely" class="sref">unlikel[           w11s=">11actrack( 442
|| r/nf_conntrack_ctb442"> 442
 465     1179in_lock11 de=DR-="sref">ct-EINVA455"> 455}
tuplehash[118="L509" class="line" name="L509k_confirm5/a>(struc1181in_lock1180                re1180<>118ls_node<+code=ct" class="sret442"> 442
 444 rc442"> 442
 442
la"ge _becllter/t/netfilter/nf_tb442"> 442
tuplehash[ 442
 444dsnntrack_core.c#Ldsnonla.="net/netfilteru442"> 442
la"ge _becllter/t/netfilter/nf_tb442"> 442
tuplehash[tuplehash[ 483        1184a>]. de=DR0class="sref">tuplehash[ct-EXPORetSYMBOL_GP455"> 455}
tuplehash[tuplehash[IP_CT_DIR11" c>11f#L474"line" name="L461">"nett_port_nlattr_ts="s_sizentrack_core.c#L>[ 465     1189in_lock11et/netfilter/nf_conntrac11et/>118/a>].ikely" class="sref">unlikel[/* We're11s=">11s=a>]. de=DROPe=out" class=kla"polic5_le "> 505
 505
 444CTA_PROTO_MAXHELPEic#L446" iCTA_PROTO_MAXonla + 1/class="sref">tuplehash[           connec11mme>11s>[   11spa>119t;ct-EXPORetSYMBOL_GP455"> 455}
tuplehash[/* NF_CT_ASSER11"co>11s_conn#endLflass="sref">tuplehash[/* 11spa>119]lterr4" cT442"ter/nfi"line"  Used by ipt_REJECT and ip6t_REJECT=ea href="net/netfilter/nf_conntrack5L469"> 465     1196in_lock11line" name="L495"> 49511s/a>]. claicCvoidlh" class="sre+code=h" class= ttach" aces i="netf"sk_buffonlass="sref">ct-nskb442"> 442
aces i="netf"sk_buffonlass="sref">ct-skb442"> 442
 465     1197in_lock11med" class="sref">nf_ct_11med>119tikely" class="sref">unlikel[11sctrack( 505
tuplehash[ct-k_nafoore.c#L443" id="Lnafoonlaclass="sref">tuplehash[           connec12sme>120ls_node<+code=4" cT442"ter/nfi"line"  This ICMP is in=> verse dire"Lnon to=_he p="+ss which caused it a href="net/netfilter/nf_conntrack5L469"> 465     12s2in_lock12span class="comment">   12spa>120> 451[[ 442
tuplehash[/* NF_CT_ASSER12sco>120href="+code=N_cont-> 455}
 465     12s4in_lock12st/netfilter/nf_conntrac12st/>12s#L493" id="L4oto_ntrat/netfilter/nf_k_nafoore.c#L443" id="Lnafoonlaref="net/netfilterIP_netRELATEDtREPLYore.c#L443" id=IP_netRELATEDtREPLYonlaclass="sref">tuplehash[/* 12spa>120]lter/nf_connelselass="sref">tuplehash[ 495120/a>].tuplehash[nf_ct_12sed>120tlass="sref">tuplehash[ 465     12s9in_lock12st/netfilter/nf_conntrac12st/>1209 451 442
 444>nttntrack_core.c#L>[="L464reftfilter/nf_conntrack_core.c#L443" id="L443"name="L444"> 444tt_gonera_" tuplehash[ 442
 444>nttnafoore.c#L443" id=>nttnafoonlaref="net/netfilterk_nafoore.c#L443" id="Lnafoonlaclass="sref">tuplehash[[ 442
 444>nttntrack_core.c#L>[="L464/class="sref">tuplehash[/* See if ther12"co>1212L493 href="+code=EEXIST" class5  struct 5a href="+12t3in_lock12nt">           NAT could12nt">1213 451lass="sref">tuplehash[       12 cl>121#L493r4" cT442"ter/nfi"line/* BaL50 ">  ya dead! a href="net/netfilter/nf_conntrack5L469"> 465     1215in_lock12code=hash" class="sref">12cod>1215; 4h" "> 505
 465     1216in_lock12class="sref">IP_CT_DIR_O12cla>121/a>].="sref">ct-ge _next_/a>pse" pselter/epl_hash" class="sre+coonntrack_core.c#L>onlterfs="sref">ct-conntrack_core.c#L>onlter,="lin(s="sref">ct-iter"  505
et/netfilter/nf_conntrack5L469"> 465     12t7in_lock12h" class="sref">h-&g12h" >12tt,  465     12t8in_lock12class="sref">nf_ct_tuple12cla>121#L474ikely" class="sref">unlikel[ 518            1218">1219 451 465 465tuplehash[repl_12has>12ha,  505
tuplehash[tupl12eha>12h>[ct-c"> 505
tuplehash[12 hr>1222, tuplehash[[tuplehash[ 444ttcore.c#L464" id="L464.="net/netfilterhtab"s_sizentrack_core.c#Lhtab"s_sizeL464cn(s="sref">ct-bu"+ss" unlikel[122]lter/nf_conntrack_c+h" class="sre+chlist_nulls_for_each_"lir5"> 505
 444n"> 505
onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterhash" ct-bu"+ss"  444hnnre+" unlikel[IP_CT_DIR_OR12las>122/a>]. 444k_core.c#L464" id="L464ref="net/netfilter>[[tuplehash[12ht,  444data"  465     1228in_lock12" cl5ss="s528nf_conntrac12" c>12hctrack(ct-foune" tuplehash[h12et/>123ls_node<+code=ct" class="srehlist_nulls_for_each_"lir5"> 505
 444n"> 505
onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterun stfirmedntrack_core.c#Lun stfirmedonlaaa"L444"> 444hnnre+" unlikel[/*5See if there&12omm>123t;, tupe="_core.c#L443" id="L443"ref="net/netfilter>[[tuplehash[123_conn>( 444data"  465     1234in_lock12clas5="sre53ent">       12cla>123#L493" id="L4oto_ntrast/a>, tupe="set_bitore.c#L443" id=set_bitonla/t/netfilter/nf_IPS_DYING_BITHELPEic#L446" iIPS_DYING_BITonlaaatfilter/nf_conntrack_core.c#L443" id="L443"name="L444"> 444 clauies
tuplehash[        12h" >123]lter/nf_conn href="+code=EEXIST" class5  struct 5a href="+1236in_lock12clas5="sre5">nf_ct_tuple12cla>1236s_node<+code=ct" class="srespin_unlt_f_bh" [tuplehash[5436            1236">123t,  de=DROPe=out" class=NUL455"> 455}
tuplehash[repl_12has>123#L474="sref">ct-foune" tuplehash[IP_CT_DI12Y" >1239 451 442
 444tt_gonera_" tuplehash[h-&g12h" >124  451[tuplehash[124ls_node<+code> de=DROPe=out" class=k_core.c#L464" id="L464class="sref">tuplehash[54411241">1242L493 href="+code=EEXIST" class5  struct 5a href="+12h3in_lock12et/n5tfilt5r/nf_conntrac12et/>1243 451lass="sref">tuplehash[12h#L493voidlh" class="sre+code=t_iterate_cleanupntrack_core.c#Lode=t_iterate_cleanuplter/epl_hash" class="sre+coonntrack_core.c#L>onlterfs="sref">ct-conntrack_core.c#L>onlter,lass="sref">tuplehash[/* 12" c>124]lter/nf_conntrack_c+de<+code  ="lin(s="sref">ct-iter"  505
et/netfilter/nf_conntrack5L469"> 465     1246in_lock12ash"5class54mment">/* ip12ash>124/a>]. 465     1247in_lock12"+co5e=net54        ICMP12"+c>124tikely" class="sref">unlikel[(&am54           w12bh<>124ctrack( 505
tuplehash[tuplehash[125="L509" class="line" name="L509k_confirm5/a>(struc1251in_lock12et/n5tfilt55ass="sref">h12et/>125ls_node<+codewhile (/t/netfilter/nf_k_core.c#L464" id="L464ref="net/netfilterge _next_/a>pse" pselter/="sref">ct-conntrack_core.c#L>onlter,=="sref">ct-iter"  444data"  455}
unlikel[,  465     1253in_lock12ass=5sref"5net, 125_conn>( 444t443"> 443        L443"> onla//et/netfilter/nf_conntrack5L469"> 465     1254in_lock12bh(&am5;tupe="death_by_t443"> 443        death_by_t443"> lter/(1" class=lo50)/nf_conntrack_ck_core.c#L464" id="L464/class="sref">tuplehash[12ame>125]lter/nf_conntrack_c+h4" cT442"ter/nfi"line"  ..=eelse=_he t443r will ge  him soon=ea href="net/netfilter/nf_conntrack5L469"> 465     1256in_lock12t/ne5filte5/nf_coref="ne12t/n>125ter/nf_conntrack_core.c#L518" i_">NF_CT_5L(125t, tuplehash[ 455}
tuplehash[ 42112n> 451epl_hash" class="sre+cf="nett=flush_reportes
unlikel[, 1263 451/*5line"0u3t;tuplehash[nf_connt12h" >126#L493" id="L4"lint/netfilter/nf_reportes
tuplehash[     12="+>126]lter class="sref">tuplehash[126ter/nf_conntrack_core.c#L518" i_">NF_CT_5L(1267; 505
NF_CT_5L(126#L474ikely" class="sref">unlikel[1269 451tuplehash[127a, tuplehash[127ls_no+code=tupleL26170         42112et/>127> 451tuplehash[-> 444 copntrack_core.c#L coptracre= 0/f_conntrack_core.c#L518" i_">NF_CT_5L( 444 copntrack_core.c#L coptracrent/netfilter/nf_kt443_to_nies
tuplehash[tuplehash[/* ip12an >127/a>]. () will retryea href="net/netfilter/nf_conntrack5L469"> 465     1277in_lock12comment">           ICMP12com>1277ref="+code=N_cont-> 465 465ct-i"  465     1278in_lock12s="comment">           w12s=">127ctrack( 444pie" ct-fr"  444reportes
NF_CT_5L( de=DR1class="sref">tuplehash[128="L509" class="line" name="L509k_confirm5/a>(struc1281in_lock1280                re1280<>128ls_node<+code=4" cT442"ter/nfi"line"  Avoidl_he deliv3ry ofl_he deeploy ev"li in=death_by_t443"> ()=ea href="net/netfilter/nf_conntrack5L469"> 465     1282in_lock12et/netfilter/nf_conntrac12et/>12f> 451 444 clauies
tuplehash[ de=DR1class="sref">tuplehash[ 483        1284a>]. href="+code=EEXIST" class5  struct 5a href="+1285in_lock12code=hnnode" class="sref12cod>128]lterlass="sref">tuplehash[ 505
NF_CT_5L(unlikel[IP_CT_DIR12" c>1288ref="+code=N> de=DR1class="sref">tuplehash[/* We're12s=">129="L509" class="line" name="L509k_confirm5/a>(struc1291in_lock12mment">           connec12mme>12s>[   12spa>129t;unlikel[/* NF_CT_ASSER12"co>129href="+code=N_cont-> 465     1294in_lock12et/netfilter/nf_conntrac12et/>129#L493" id="L4oto_ntrat/netfilter/nf_vfref" tuplehash[/* 12spa>129]lter/nf_connelselass="sref">tuplehash[ 495129/a>].tuplehash[nf_ct_12med>129t, tuplehash[ 455}
tuplehash[           connec13sme>130>[ct-conntrack_core.c#L>onlter,=ref="+code=out"uomme5t">/*5line"0u3t; 465     13s2in_lock13span class="comment">   13spa>130t;unlikel[/* NF_CT_ASSER13sco>130href="+code=Nepl_hash" class="sre+cf="nett=flush_reportes
unlikel[13s#L493" id="L4oto_ntra.="net/netfilterpie" unlikel[/* 13spa>130]lter/nf_conntrack_c+.="net/netfilterreportes
unlikel[ 495130/a>].tuplehash[nf_ct_13sed>130t, ct-conntrack_core.c#L>onlter,=="sref">ct-kill_reportes
tuplehash[ 455}
tuplehash[ct-conntrack_core.c#L>onlter/et/netfilter/nf_conntrack5L469"> 465     13t2in_lock13"comment">/* See if ther13"co>131t;unlikel[           NAT could13nt">131href="+code=Nepl_hash" class="sre+cel[ 465tuplehash[       13 cl>1314ref="+code=Nepl_hash" class="sre+cel[ 505
tuplehash[13cod>1315ref="+code=Nepl_hash" class="sre+chlist_nulls_nre+" ct-c"> 505
tuplehash[IP_CT_DIR_O13cla>131ter/nf_conntrack_core.c#L518" i_">NF_CT_5L(h-&g13h" >131t, [tuplehash[nf_ct_tuple13cla>1318,  505
 444n"> 505
onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterdying"  444hnnre+" unlikel[ 518            1318">131/a>]. 444ttcore.c#L464" id="L464ref="net/netfilter>[[tuplehash[repl_13has>132eL493" id="L4oto_de=t"4" cT442"ter/nfi"line"  n ver fails to=remove=_hem, no listoners at=_his point a href="net/netfilter/nf_conntrack5L469"> 465     1321in_lock13ehash" class="sref">tupl13eha>132>[[[tuplehash[13 hr>132> 451[tuplehash[132]lterlass="sref">tuplehash[IP_CT_DIR_OR13las>132/a>]. claicC"lint/netfilter/nf_uref="+ctfiies
 465     1327in_lock13href5"+cod52k_hash_check13hre>132tikely" class="sref">unlikel[13hctrack( 444cpucore.c#L464" id=puL464class="sref">tuplehash[tuplehash[unlikel[h13et/>133>[ 505
 444kpucore.c#L464" id=puL464/class="sref">tuplehash[/*5See if there&13omm>1332, tuplehash[133_conn>( 444tt_gonera_" tuplehash[       13cla>133#L493" id="L4 href="+code=EEXIST" class5  struct 5a href="+1335in_lock13h" c5ass="53nt">        13h" >133]lter/nf_conn> de=DROPe=out" class=kn_core.c#L464" id=nsonlaclass="sref">tuplehash[nf_ct_tuple13cla>1336s_no href="+code=EEXIST" class5  struct 5a href="+1337in_lock1336">5436            1336">133tlass="sref">tuplehash[repl_13has>133#L474 claicCvoidlh" class="sre+code=h" class=cleanup_ini _netes
 465     1339in_lock13Y" c5ass="5ref">IP_CT_DI13Y" >133/a>].ikely" class="sref">unlikel[h-&g13h" >134  451NF_CT_5L(tuplehash[54411341">1342, tuplehash[ 444CONFIG_NF_CONNTRACK_ZONESntrack_core.c#LCONFIG_NF_CONNTRACK_ZONES, tuplehash[1344 451[[[[tuplehash[/* 13" c>134]lter#endLflass="sref">tuplehash[/* ip13ash>1346s_no href="+code=EEXIST" class5  struct 5a href="+1347in_lock13"+co5e=net54        ICMP13"+c>134tlass="sref">tuplehash[ct-conntrack_core.c#L>onlter/et/netfilter/nf_conntrack5L469"> 465     1349in_lock13et/n5tfilt54            13et/>134/a>].ikely" class="sref">unlikel[135="L50=="sref">ct-i_see_dead_peo="sntrack_core.c#Li_see_dead_peo="s"L50: css="sref">tuplehash[h13et/>135ls_node<+code=ct" class="sre>[ct-conntrack_core.c#L>onlter,=="sref">ct-kill_al_" ct-NUL455"> 455}
tuplehash[ct-conntrack_core.c#L>onlter/class="sref">tuplehash[, 135href="+code=N_cont->onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfiltercountcore.c#L464" id=ountlter/ != 0/likely" class="sref">unlikel[(&am5;tuplehash[13ame>135]lter/nf_conntrack_c+gotc+="sref">ct-i_see_dead_peo="sntrack_core.c#Li_see_dead_peo="s"L50class="sref">tuplehash[135/a>].tuplehash[tuplehash[onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterhash" onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterhtab"s_sizentrack_core.c#Lhtab"s_sizeL464)class="sref">tuplehash[ct-conntrack_core.c#L>onlter/class="sref">tuplehash[ 465 _finies
 _finilter/="sref">ct-conntrack_core.c#L>onlter/class="sref">tuplehash[ct-conntrack_core.c#L>onlter/class="sref">tuplehash[136> 451ct-conntrack_core.c#L>onlter/class="sref">tuplehash[[ct-conntrack_core.c#L>onlter/class="sref">tuplehash[nf_connt13h" >1364 451[ct-conntrack_core.c#L>onlter/class="sref">tuplehash[     13="+>1365 451onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilter>[tuplehash[1366s_node<+code=ct" class="srekfref" onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterslabnntrntrack_core.c#Lslabnntrlter/class="sref">tuplehash[136t, onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterstatore.c#L443" id=statlter/class="sref">tuplehash[136ctrac href="+code=EEXIST" class5  struct 5a href="+1369in_lock13clas5="sre56/nf_cT could13cla>136/a>].lass="sref">tuplehash[137a"4" cT442"ter/nfi"line"  MisheaaL50 _he voices in=his heae, our hero wonders how he'shref="net/netfilter/nf_conntrack5L469"> 465     1371in_lock13 hre5="+co57/nf_conntrac13 hr>137ls_no"4" cT442"ter/nfi"linehresupposed to=kill _he mal_=ea href="net/netfilter/nf_conntrack5L469"> 465     1372in_lock13et/n5tfilt57lass="sref">13et/>137> 451voidlh" class="sre+code=h" class=cleanupes
ct-conntrack_core.c#L>onlter/et/netfilter/nf_conntrack5L469"> 465     1373in_lock13hash"+code=h" class="sre13has>137href=ikely" class="sref">unlikel[ct-conntrack_core.c#L>onlter,=tfilter/nf_conntrackini _netes
 465     1375in_lock13et/netfilter/nf_conntrac13et/>137]lter/nf_conntrack_c+h" class="sre+cRCU_INIT_POINTERes
ct-ipe=t_attaches
ct-NUL455"> 455}
tuplehash[/* ip13an >137ter/nf_conntrack_core.c#L518" i_">NF_CT_5L(           ICMP13com>1377ref="+code=Ns4" cT442"ter/nfi"line"  This makes sure al_ curr"li p="+ets have p=ssed throughhref="net/netfilter/nf_conntrack5L469"> 465     1378in_lock13s="comment">           w13s=">137ctrac"4" cT442"ter/nfi"linehreeeeeeeeef_conntra fr   work.  Rol_ on, two-stage modu"sltef="net/netfilter/nf_conntrack5L469"> 465     1379in_lock13 465     138pin_lock13fo) != tuplehash[ct-conntrack_core.c#L>onlter/class="sref">tuplehash[ct-conntrack_core.c#L>onlter/class="sref">tuplehash[tuplehash[ 483        138#L493" id="L4_cont->on_eqlter/="sref">ct-conntrack_core.c#L>onlter,=tfilter/nf_conntrackini _netes
unlikel[ct-ode=t_deeploy" ct-NUL455"> 455}
tuplehash[tuplehash[IP_CT_DIR13" c>138ctrac href="+code=EEXIST" class5  struct 5a href="+1389in_lock13et/netfilter/nf_conntrac13et/>138/a>].lass="sref">tuplehash[/* We're13s=">139="L50voidlst/netfilter/nf_ode=t_al_oc_hashtab"sntrack_core.c#Lode=t_al_oc_hashtab"slter/1" class="linst/netfilter/nf_sizepntrack_core.c#L izeplter,="lint/netfilter/nf_nullsntrack_core.c#Loullslter/et/netfilter/nf_conntrack5L469"> 465     1391in_lock13mment">           connec13mme>13s>[unlikel[   13spa>139> 451ct-hash" tuplehash[/* NF_CT_ASSER13"co>139href="+code=N1" class="lint/netfilter/nf_nr_slotsntrack_core.c#Lor_slotslter,=="sref">ct-i" tuplehash[ct-szes
tuplehash[/* 13spa>139]lterlass="sref">tuplehash[ 4951396s_node<+code=ct" class="sreBUILD_BUG_ONes
tuplehash[nf_ct_13med>139t, tuplehash[tuplehash[ct-GFP_KERNE455"> 455}
tuplehash[tuplehash[           connec14sme>140ls_node<+code_con!ref="+code=out"hash" unlikel[   14spa>140t;, "el[tuplehash[/* NF_CT_ASSER14sco>140_conn>(tuplehash[/* 14spa>140]lterlass="sref">tuplehash[ 495140/a>].-> 465     14s7in_lock14sed" class="sref">nf_ct_14sed>140t, ct-i" ct-i"  465     14s8in_lock14sfirming conntrack %14sfi>140ctrack(ct-INIT_HLIST_NUL4S_HEAD" ct-i" ct-i" tuplehash[tuplehash[tuplehash[/* See if ther14"co>141t; 455}
tuplehash[           NAT could14nt">1413 451lass="sref">tuplehash[       14 cl>1414ref="lint/netfilter/nf_n[ct-kpntrack_core.c#Lkplter/et/netfilter/nf_conntrack5L469"> 465     1415in_lock14code=hash" class="sref">14cod>1415ref=ikely" class="sref">unlikel[IP_CT_DIR_O14cla>141/a>].tuplehash[h-&g14h" >141t, tuplehash[nf_ct_tuple14cla>1418, ct-hash" ct-old_hash" tuplehash[ 518            1418">141/a>]. 465tuplehash[repl_14has>142a, tuplehash[tupl14eha>142ls_no+code=tupleL26170         42114 hr>142> 451-> 444nsproxy"  444net_nies
         421 de=DR-OPe=out" class=EOPNOTSUPP55"> 455}
tuplehash[tuplehash[1425 451 465     1426in_lock14lass5"sref5>IP_CT_DIR_OR14las>142/a>].         421142t, ct-kpntrack_core.c#Lkplter/class="sref">tuplehash[14hctraclass="sref">tuplehash[ct-NUL455"> 455}
tuplehash[         421h14et/>143>[ 455}
tuplehash[/*5See if there&14omm>1432, tuplehash[1433 451tuplehash[       14cla>143#L493" id="L4_con!ref="+code=out"hash" tuplehash[        14h" >143]lter/nf_conntrack_c+> de=DR-OPe=out" class=ENOMEM55"> 455}
tuplehash[nf_ct_tuple14cla>143ter/nf_conntrack_core.c#L518" i_">NF_CT_5L(5436            1436">1437ref="+code=Ns4" cT442"ter/nfi"line"  Lookups in=_he old hash might happen in=parallel,hwhich means wsltef="net/netfilter/nf_conntrack5L469"> 465     1438in_lock14hash5 clas5="sref">repl_14has>143ctrac"4" cT442"ter/nfi"linehreeeeeee* might get=false negatives duaL50 469"ection ltokup. New 469"ectionshref="net/netfilter/nf_conntrack5L469"> 465     1439in_lock14Y" c5ass="5ref">IP_CT_DI14Y" >143/a>]."4" cT442"ter/nfi"linehreeeeeee* created because of a=false negative won't make ii into=_he hashL4ef="net/netfilter/nf_conntrack5L469"> 465     144pin_lock14h" c5ass="5ref">h-&g14h" >144a"4" cT442"ter/nfi"linehreeeeeee* though since=_hat+> quired takL50 _he lt_f.L4ef="net/netfilter/nf_conntrack5L469"> 465     1441in_lock14clas5="sre54          re14cla>144ls_no"4" cT442"ter/nfi"linehreeeeeee* href="net/netfilter/nf_conntrack5L469"> 465     14h2in_lock1441">54411441">144> 451[tuplehash[ct-i" ct-i" unlikel[1444 451 505
ct-i" unlikel[/* 14" c>144]lter/nf_conntrack_c+ 505
ct-i" tuplehash[/* ip14ash>144/a>]. 465 444hnnre+" tuplehash[144t, [[tuplehash[ct-hlist_nulls_del_rcucore.c#L464" idhlist_nulls_del_rculter/tfilter/nf_conntrackh"  444hnnre+" tuplehash[ct-bu"+ss"  444fsref"  444>[[tuplehash[145eL493" id="L4oto_de=ttttttttttttttttttttttttt"+++++++++="sref">ct-hashsizentrack_core.c#Lhashsizelter/class="sref">tuplehash[h14et/>145>[ct-hlist_nulls_add_heae_rcucore.c#L464" idhlist_nulls_add_heae_rculter/tfilter/nf_conntrackh"  444hnnre+" ct-bu"+ss" tuplehash[, < href="+code=EEXIST" class5  struct 5a href="+1453in_lock14ass=5sref"5net, 145href="+code=N href="+code=EEXIST" class5  struct 5a href="+1454in_lock14bh(&am5;14ame>145]lter/nf_conn="sref">ct-old_hash" tuplehash[145ter/nf_conntrack_core.c#L518" i_">NF_CT_5L(145t, tuplehash[tuplehash[[tuplehash[tuplehash[146> 451 de=DR0class="sref">tuplehash[nf_connt14h" >1464 451OPe=out" class=EXPORetSYMBOL_GP455"> 455}
tuplehash[     14="+>146]lterlass="sref">tuplehash[1466s_not/netfilter/nf_modu"s_param_cal_" tuplehash[146t, tuplehash[146ctraclass="sref">tuplehash[146/a>].voidlh" class="sre+code=i_uref="+ed_status_or" [ct-bitsntrack_core.c#LbitsL464/lass="sref">tuplehash[147aikely" class="sref">unlikel[tuplehash[14et/>1472, tuplehash[tuplehash[ 444kpucore.c#L464" id=puL464/.="net/netfilterstatusntrack_core.c#Lstatus 451<|eft/netfilter/nf_bitsntrack_core.c#LbitsL464class="sref">tuplehash[/* ip14an >1476s_not/netfilter/nf_EXPORetSYMBOL_GP455"> 455}
[tuplehash[           ICMP14com>147tlass="sref">tuplehash[           w14s=">147#L474 claicC"lint/netfilter/nf_n[ 465     1479in_lock14unlikel[) != tuplehash[ct-cpucore.c#L464" id=puL464class="sref">tuplehash[tuplehash[ 465     1484in_lock1483"> 483        148#L493"4" cT442"ter/nfi"linehreeeeeee* mach    has 512 bu"+sss. ame== 1GB mach   s have 16384 bu"+sss. * href="net/netfilter/nf_conntrack5L469"> 465     1485in_lock14code=hnnode" class="sref14cod>148]lter/nf_conn_con!ref="+code=out"ode=confirm5/htab"s_sizentrack_core.c#Lode=confirm5/htab"s_sizelter/likely" class="sref">unlikel[unlikel[ 465     1488in_lock14" class="sref">IP_CT_DIR14" c>148ctrack(tuplehash[-> 465     149pin_lock14s="comment">/* We're14s=">149eL493" id="L4oto_de=ttttttttt="net/netfilter>[tuplehash[           connec14mme>149>[ 465     1492in_lock14span class="comment">   14spa>149t;, [tuplehash[/* NF_CT_ASSER14"co>1493 451lass="sref">tuplehash[ 465     1495in_lock14span class="comment">/* 14spa>149]lter"4" cT442"ter/nfi"linehreeeeeeeeeeeeeee* with=_he old epl_haslist_heaes. When a tab"s eize is givenhref="net/netfilter/nf_conntrack5L469"> 465     1496in_lock14line" name="L495"> 4951496s_no"4" cT442"ter/nfi"linehreeeeeeeeeeeeeee* we use _he old value of 8 to=avoidlreducL50 _he max.href="net/netfilter/nf_conntrack5L469"> 465     1497in_lock14med" class="sref">nf_ct_14med>149t"4" cT442"ter/nfi"linehreeeeeeeeeeeeeee* "liries. * href="net/netfilter/nf_conntrack5L469"> 465     1498in_lock14nfirming conntrack %14nfi>149ctrack(tuplehash[ 465tuplehash[           connec15sme>150ls_no+code=tupleL26170         421   15spa>150> 451"el[tuplehash[/* NF_CT_ASSER15sco>150_conn>(tuplehash[ 465tuplehash[/* 15spa>150]lter#ifdefhref="+code=out"CONFIG_NF_CONNTRACK_ZONESntrack_core.c#LCONFIG_NF_CONNTRACK_ZONESs_no+code=tupleL26170         421 4951506s_node<+code=ct" class="sreretes
[[[[tuplehash[nf_ct_15sed>150t, -> 465     15s8in_lock15sfirming conntrack %15sfi>150ctrack(ct-err_extend" tuplehash[tuplehash[ 465     15t1in_lock15et/netfilter/nf_conntrac15et/>151ls_node<+code=ct" class="srefor_each_possib"s_cpucore.c#L464" idfor_each_possib"s_cpulter/t/netfilter/nf_kpucore.c#L464" id=puL464/likely" class="sref">unlikel[/* See if ther15"co>151t;,  444kpucore.c#L464" id=puL464/class="sref">tuplehash[           NAT could15nt">151_conn>( 444tt_netes
tuplehash[       15 cl>1514 451 444tt_genera_" tuplehash[15cod>151]lter/nf_conn href="+code=EEXIST" class5  struct 5a href="+1516in_lock15class="sref">IP_CT_DIR_O15cla>151/a>]. 465     15t7in_lock15h" class="sref">h-&g15h" >151t, [ct-IPS_UNTRACKED" tuplehash[nf_ct_tuple15cla>1518,  de=DR0class="sref">tuplehash[ 518            1518">151/a>].lass="sref">tuplehash[repl_15has>152a#ifdefhref="+code=out"CONFIG_NF_CONNTRACK_ZONESntrack_core.c#LCONFIG_NF_CONNTRACK_ZONESs_no+code=tupleL26170         421tupl15eha>152ls_no="sref">ct-err_extend"          42115 hr>152> 451#endiflass="sref">tuplehash[tuplehash[152]lterlass="sref">tuplehash[IP_CT_DIR_OR15las>1526s_no"4" cT442"ter/nfi"line/*href="net/netfilter/nf_conntrack5L469"> 465     1527in_lock15href5"+cod52k_hash_check15hre>152t"4" cT442"ter/nfi"lineh* We need to=use special "eull" values, noi usss="l hash tab"sltef="net/netfilter/nf_conntrack5L469"> 465     1528in_lock15" cl5ss="s528nf_conntrac15" c>152ctrac"4" cT442"ter/nfi"lineh* href="net/netfilter/nf_conntrack5L469"> 465     1529in_lock15et/n5tfilt5r/nf_cT could15et/>1529 451#def    OPe=out" class=UNCONFIRMED_NUL4S_VA455"> 455}
 465     153pin_lock15bh(&am53/* We're15bh<>153  451#def    OPe=out" class=DYING_NUL4S_VA455"> 455}
 465     1531in_lock15et/n5tfilt53ass="sref">h15et/>153ls_no+code=tupleL26170         421/*5See if there&15omm>1532, ct-conntrack_core.c#L>onlter/et/netfilter/nf_conntrack5L469"> 465     1533in_lock15code5hash"53/nf_conntrac15cod>153href=ikely" class="sref">unlikel[       15cla>153#L493" id="L4_lint/netfilter/nf_retes
tuplehash[        15h" >153]lterlass="sref">tuplehash[nf_ct_tuple15cla>1536s_node<+code=ct" class="sreatomiccsetes
 444ttcore.c#L464" id="L464.="net/netfiltercoulicore.c#L464" id=oulilter,=0/class="sref">tuplehash[5436            1536">153t, onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilteruna hfirmed"  444UNCONFIRMED_NUL4S_VA455"> 455}
tuplehash[repl_15has>1538, onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterdying"ore.c#L464" iddyingonlaaa"L444"> 444DYING_NUL4S_VA455"> 455}
tuplehash[IP_CT_DI15Y" >1539 451onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilter clacore.c#L464" id clalterref="net/netfilteral_oc_perkpucore.c#L464" idal_oc_perkpulter/epl_hash" class="sre+ciptuplehash[h-&g15h" >154  451onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilter clacore.c#L464" id clalter/likely" class="sref">unlikel[154>[ 455}
tuplehash[54411541">154t;, ct-err_ clacore.c#L464" iderr_ claL464class="sref">tuplehash[1544a>].lass="sref">tuplehash[/* 15" c>154]lter/nf_connref="+code=out"conntrack_core.c#L>onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilter labnt">core.c#L464" id labnt">lterref="net/netfilterkaspr"lifcore.c#L464" idkaspr"liflter/t/netfilter/nf_GFP_KERNE455"> 455}
"el[onlter/class="sref">tuplehash[/* ip15ash>154/a>].onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilter labnt">core.c#L464" id labnt">lter/likely" class="sref">unlikel[154t,  455}
tuplehash[ct-err_ labnt">core.c#L464" iderr_ labnt">L464class="sref">tuplehash[155="L509" class="line" name="L509k_confirm5/a>(struc1551in_lock15et/n5tfilt55ass="sref">h15et/>155ls_node<+code=ct" class="sre>onntrack_core.c#L>onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilter09k_confirm5/aachepntrack_core.c#L09k_confirm5/aacheplterref="net/netfilterkmem/aache_createcore.c#L464" idkmem/aache_createlter/t/netfilter/nf_conntrack_core.c#L>onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilter labnt">core.c#L464" id labnt">lter,lass="sref">tuplehash[, <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<tuplehash[, 155_conn>( 444NUL455"> 455}
tuplehash[1554 451onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilter09k_confirm5/aachepntrack_core.c#L09k_confirm5/aacheplter/likely" class="sref">unlikel[15ame>155]lter/nf_conn++++++++h" class="sre+cpr"lifntrack_core.c#Lpr"liflter/t/netfilter/nf_KERN_ERRntrack_core.c#LKERN_ERRlter/=4" cT442"terepling">"Unab"s tc+create el[tuplehash[155/a>]. 455}
tuplehash[ct-err_aachecore.c#L464" iderr_aacheL464class="sref">tuplehash[tuplehash[onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterhtab"s_sizentrack_core.c#Lhtab"s_sizeL464ref="net/netfilter>[tuplehash[ 444ttcore.c#L464" id="L464.="net/netfilterhash" onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterhtab"s_sizentrack_core.c#Lhtab"s_sizeL464,=1/class="sref">tuplehash[156> 451onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterhash" unlikel[, 156_conn>( 455}
tuplehash[nf_connt15h" >1564 451"Unab"s tc+create el[tuplehash[     15="+>156]lter/nf_conn++++++++gotc+="sref">ct-err_hash" tuplehash[1566, 156t, [onlter/class="sref">tuplehash[1568 451 465     1569in_lock15clas5="sre56/nf_cT could15cla>156/a>].ct-err_expec " tuplehash[157  451[onlter/class="sref">tuplehash[157ls_node<+code_cont/netfilter/nf_retes
 465     1572in_lock15et/n5tfilt57lass="sref">15et/>157t;, ct-err_acc " tuplehash[[onlter/class="sref">tuplehash[ 465     1575in_lock15et/netfilter/nf_conntrac15et/>157]lter/nf_conn++++++++gotc+="sref">ct-err_tstfil" tuplehash[/* ip15an >1576s_node<+code=ct" class="sreretes
[onlter/class="sref">tuplehash[           ICMP15com>157t, -> 465     1578in_lock15s="comment">           w15s=">157ctrack(ct-err_eaachecore.c#L464" iderr_eaacheL464class="sref">tuplehash[1579 451[onlter/class="sref">tuplehash[158  451-> 465     1581in_lock1580                re1580<>158>[ct-err_timeou " tuplehash[[onlter/class="sref">tuplehash[ 465     1584in_lock1583"> 483        1584 451ct-err_helper" tuplehash[tuplehash[         421tuplehash[IP_CT_DIR15" c>158ctrac="sref">ct-err_timeou "          4211589 451onlter/class="sref">tuplehash[/* We're15s=">159eL493="sref">ct-err_eaachecore.c#L464" iderr_eaacheL464:+code=tupleL26170         421           connec15mme>159ls_node<+code=ct" class="sre>[onlter/class="sref">tuplehash[   15spa>159t;ct-err_tstfil"          421/* NF_CT_ASSER15"co>1593 451onlter/class="sref">tuplehash[         421/* 15spa>159]lter/nf_connref="+code=out"cde=confirm5/expec _finintrack_core.c#Lode=confirm5/expec _finilter/t/netfilter/nf_conntrack_core.c#L>onlter/class="sref">tuplehash[ 4951596s_not/netfilter/nf_err_expec "          421nf_ct_15med>159t, onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterhash" onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterhtab"s_sizentrack_core.c#Lhtab"s_sizeL464/class="sref">tuplehash[ct-err_hash"          4211599 451 505
onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilter09k_confirm5/aachepntrack_core.c#L09k_confirm5/aacheplter/class="sref">tuplehash[ct-err_aachecore.c#L464" iderr_aacheL464:+code=tupleL26170         421           connec16sme>160ls_node<+code=ct" class="srekfref"> 505
onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfilterslabnt">core.c#L464" id labnt">lter/class="sref">tuplehash[   16spa>160t;ct-err_slabnt">core.c#L464" iderr_ labnt">L464:+code=tupleL26170         421/* NF_CT_ASSER16sco>1603 451onltername="L444"> 444ttcore.c#L464" id="L464.="net/netfiltersclacore.c#L464" id clalter/class="sref">tuplehash[         421/* 16spa>160]lter/nf_conn> de=DRt->tuplehash[ 4951606s_no href="+code=EEXIST" class5  struct 5a href="+16s7in_lock16sed" class="sref">nf_ct_16sed>160tlass="sref">tuplehash[ct-sclass="sref64" id 1/a>].<(s="sref">ct-cde=t_nat_offsetes
tuplehash[tuplehash[/*5line"0u32, tuplehash[ct-EXPORetSYMBOL_GP455"> 455}
tuplehash[/* See if ther16"co>1612, tuplehash[           NAT could16nt">161_conn"lint/netfilter/nf_n[ct-conntrack_core.c#L>onlter/et/netfilter/nf_conntrack5L469"> 465     16t4in_lock16 class="comment">       16 cl>1614 451ikely" class="sref">unlikel[16cod>161]lter/nf_conn_lint/netfilter/nf_retes
tuplehash[IP_CT_DIR_O16cla>161ter/nf_conntrack_core.c#L518" i_">NF_CT_5L(h-&g16h" >161t, ->onlter,=tfilter/nf_conntrackini _netes
unlikel[nf_ct_tuple16cla>161ctrack(tuplehash[ 518            1618">161/a>]. 465     162pin_lock16hash" class="sref">repl_16has>162eL493" id="L4oto_de=tttttttttgotc+="sref">ct-ou _ini _netes
tuplehash[tupl16eha>162ls_node<+code href="+code=EEXIST" class5  struct 5a href="+1622in_lock16 hre5="+co52lass="sref">16 hr>162> 451[onlter/class="sref">tuplehash[ 465     1624in_lock16e=nf5ct_zo52t" class="sr16e=n>1624 451ct-ou _protces
tuplehash[162]lter/nf_connref="+code=out"retes
[tuplehash[IP_CT_DIR_OR16las>162/a>].-> 465     1627in_lock16href5"+cod52k_hash_check16hre>162t, ct-ou _netes
tuplehash[162ctraclass="sref">tuplehash[onlter,=tfilter/nf_conntrackini _netes
unlikel[(&am53/* We're16bh<>163eL493" id="L4oto_de=tt4" cT442"ter/nfi"line"  For=use by REJECT target=* href="net/netfilter/nf_conntrack5L469"> 465     1631in_lock16et/n5tfilt53ass="sref">h16et/>163>[tuplehash[/*5See if there&16omm>163t;, <=ct" class="sreRCU_INIT_POINTERntrack_core.c#LRCU_INIT_POINTERlter/er/nf_conntrackcde=t_destro5"> 505
tuplehash[1633 451lass="sref">tuplehash[       16cla>1634 451 465     1635in_lock16h" c5ass="53nt">        16h" >163]lter/nf_conn++++++++h" class="sre+cRCU_INIT_POINTERntrack_core.c#LRCU_INIT_POINTERlter/er/nf_conntrackcde=t_nat_offsetes
 444NUL455"> 455}
tuplehash[nf_ct_tuple16cla>1636, 5436            1636">163t,  de=DR0class="sref">tuplehash[repl_16has>163ctraclass="sref">tuplehash[IP_CT_DI16Y" >1639 451="sref">ct-ou _netes
 421h-&g16h" >164  451 465onlter/class="sref">tuplehash[164ls_no="sref">ct-ou _protces
 42154411641">164> 451->onlter,=tfilter/nf_conntrackini _netes
 421164_conn>(leanupaini _netes
tuplehash[1644 451OPe=out" class=ou _ini _netes
 421/* 16" c>164]lter/nf_conn> de=DRt->tuplehash[/* ip16ash>1646s_no href="+code=EEXIST" class5  struct 5a href="+1647in_lock16"+co5e=net54        ICMP16"+c>164t
The original LXR software by _he ref="+codhttp://sourceforge.e=EEprojects/lxa">LXR /nfiuni 5L464,nthis experii"lial version by ref="+codma" co:lxa@4 ux.no">lxa@4 ux.noL464. lxa.4 ux.no kindly hosted by ref="+codhttp://www.redpill-4 pro.no">Redpill L pro ASL464,nprovider of L ux 469sultL50 and operations services since 1995.