RE: [PATCH] xt_gateway match

[Amin Azez <azez@ufomechanic.net>]

That looks about right.

Thanks

Sam

-----Original Message-----
From: "Jan Engelhardt" <jengelh@linux01.gwdg.de>
To: "Amin Azez" <azez@ufomechanic.net>
Cc: netfilter-devel@lists.netfilter.org
Sent: 05/06/07 11:16
Subject: RE: [PATCH] xt_gateway match

On Jun 4 2007 11:14, Amin Azez wrote:
>
>Thanks for looking at this, Jan. I'm away from a testing box right now, 
>but I think you got a test wrong. The gateway test is meant to exclude 
>cases where the neighbour table matches AND the daddr matches, because 
>that means the packet wasn't routed to that target AS a gateway.
>
>For nexthop we don't want to match daddr regardless, only if it is also 
>matching the neighbor table.
>
>Gateway: match neighbourtable and not match daddr
>Nexthop: match neighbour table.

Ok I am a bit narrow on this, anyway, I checked again and it looks like, 
yes, there was something wrong. I fixed it to:

	if (memcmp(&info->gateway, &neigh->primary_key, tbl->key_len) != 0)
		return false;
	if (!(info->flags & XT_GATEWAY_ROUTE))
		return true;
	iph = ip_hdr(skb);
	if (iph->daddr != info->gateway)
		return true;
	return false;

which should be matching

memcmp(&info->gateway, &skb->dst->neighbour->primary_key,
	skb->dst->neighbour->tbl->key_len) == 0 &&
((info->flags & IPT_GATEWAY_ROUTE) == 0 || iph->daddr != info->gateway)

Will resend with that.


	Jan
--