Re: [RFC, PATCH 5/5]: netfilter+ipsec - policy checks

[Patrick McHardy <kaber@trash.net>]

[-- Attachment #1: Type: text/plain, Size: 171 bytes --]

Alexander Samad wrote:
> Done some more testing and there seems to be a problem with the NAT
> table 
> 

Thanks for the report, does this patch fix it ?

Regards
Patrick

[-- Attachment #2: x --]
[-- Type: text/plain, Size: 712 bytes --]

===== net/ipv4/raw.c 1.44 vs edited =====
--- 1.44/net/ipv4/raw.c	Thu Mar 18 16:44:12 2004
+++ edited/net/ipv4/raw.c	Sat Mar 20 16:57:24 2004
@@ -257,6 +257,12 @@
 	return 0;
 }
 
+static inline int ip_dst_output(struct sk_buff *skb)
+{
+	return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL,
+	                    skb->dst->dev, dst_output, skb->dst->xfrm != NULL);
+}
+
 static int raw_send_hdrinc(struct sock *sk, void *from, int length,
 			struct rtable *rt, 
 			unsigned int flags)
@@ -308,7 +314,7 @@
 	}
 
 	err = NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
-		      dst_output);
+		      ip_dst_output);
 	if (err > 0)
 		err = inet->recverr ? net_xmit_errno(err) : 0;
 	if (err)