1 --- a/include/net/netns/conntrack.h
2 +++ b/include/net/netns/conntrack.h
3 @@ -73,6 +73,7 @@ struct netns_ct {
4 struct ctl_table_header *helper_sysctl_header;
8 unsigned int sysctl_log_invalid; /* Log invalid packets */
9 unsigned int sysctl_events_retry_timeout;
11 --- a/net/ipv4/netfilter/iptable_filter.c
12 +++ b/net/ipv4/netfilter/iptable_filter.c
14 #include <linux/netfilter_ipv4/ip_tables.h>
15 #include <linux/slab.h>
17 +#include <net/netfilter/nf_conntrack.h>
19 MODULE_LICENSE("GPL");
20 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
21 @@ -37,6 +38,7 @@ iptable_filter_hook(const struct nf_hook
22 const struct net_device *in, const struct net_device *out,
23 int (*okfn)(struct sk_buff *))
25 + enum ip_conntrack_info ctinfo;
26 const struct net *net;
28 if (ops->hooknum == NF_INET_LOCAL_OUT &&
29 @@ -46,6 +48,11 @@ iptable_filter_hook(const struct nf_hook
32 net = dev_net((in != NULL) ? in : out);
33 + nf_ct_get(skb, &ctinfo);
34 + if ((ctinfo == IP_CT_ESTABLISHED_REPLY || ctinfo == IP_CT_ESTABLISHED) &&
35 + net->ct.skip_filter)
38 return ipt_do_table(skb, ops->hooknum, in, out,
39 net->ipv4.iptable_filter);
41 --- a/net/ipv6/netfilter/ip6table_filter.c
42 +++ b/net/ipv6/netfilter/ip6table_filter.c
44 #include <linux/moduleparam.h>
45 #include <linux/netfilter_ipv6/ip6_tables.h>
46 #include <linux/slab.h>
47 +#include <net/netfilter/nf_conntrack.h>
49 MODULE_LICENSE("GPL");
50 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
51 @@ -37,6 +38,12 @@ ip6table_filter_hook(const struct nf_hoo
52 int (*okfn)(struct sk_buff *))
54 const struct net *net = dev_net((in != NULL) ? in : out);
55 + enum ip_conntrack_info ctinfo;
57 + nf_ct_get(skb, &ctinfo);
58 + if ((ctinfo == IP_CT_ESTABLISHED_REPLY || ctinfo == IP_CT_ESTABLISHED) &&
59 + net->ct.skip_filter)
62 return ip6t_do_table(skb, ops->hooknum, in, out,
63 net->ipv6.ip6table_filter);
64 --- a/net/netfilter/nf_conntrack_standalone.c
65 +++ b/net/netfilter/nf_conntrack_standalone.c
66 @@ -510,6 +510,13 @@ static struct ctl_table nf_ct_sysctl_tab
67 .extra2 = &log_invalid_proto_max,
70 + .procname = "nf_conntrack_skip_filter",
71 + .data = &init_net.ct.skip_filter,
72 + .maxlen = sizeof(int),
74 + .proc_handler = proc_dointvec,
77 .procname = "nf_conntrack_expect_max",
78 .data = &nf_ct_expect_max,
79 .maxlen = sizeof(int),
80 @@ -545,6 +552,7 @@ static int nf_conntrack_standalone_init_
81 table[2].data = &net->ct.htable_size;
82 table[3].data = &net->ct.sysctl_checksum;
83 table[4].data = &net->ct.sysctl_log_invalid;
84 + table[5].data = &net->ct.skip_filter;
86 /* Don't export sysctls to unprivileged users */
87 if (net->user_ns != &init_user_ns)