我发现以下代码删除了内核中的netfilter conntrack
int delete_nat_entry(u32 loc_ip, u32 rem_ip, u16 loc_port, u16 rem_port) {
struct nf_conntrack_tuple_hash *h;
struct nf_conntrack_tuple tuple;
struct nf_conn *ct;
memset(&tuple, 0, sizeof(tuple));
//layer 3
tuple.src.l3num = PF_INET;
tuple.src.u3.ip = htonl(loc_ip);
tuple.dst.u3.ip = htonl(rem_ip);
//layer 4
tuple.dst.protonum = IPPROTO_TCP;
tuple.dst.dir = IP_CT_DIR_ORIGINAL;
tuple.src.u.tcp.port = htons(loc_port);
tuple.dst.u.tcp.port = htons(rem_port);
h = nf_conntrack_find_get(&init_net, NF_CT_DEFAULT_ZONE, &tuple);
if (!h) {
debug_msg(KERN_INFO "cannot find conntrack tuple\n");
return -ENOENT;
}
ct = nf_ct_tuplehash_to_ctrack(h);
if (del_timer(&ct->timeout))
nf_ct_delete(ct, 0, 0);
nf_ct_put(ct);
return 0;
}
但我不知道如何在内核中集成? 以及如何从用户空间调用它?