Re: skb->mac.raw, when is does it point to ethhdr

[Amin Azez <azez@ufomechanic.net>]

YOSHIFUJI Hideaki / 吉藤英明 wrote:

>In article <d4r2n4$o39$1@sea.gmane.org> (at Thu, 28 Apr 2005 17:29:35 +0100), Amin Azez <azez@ufomechanic.net> says:
>  
>
>>I've been treating skb->mac.raw as a pointer to ethhdr and stealing mac 
>>addresses when conntrack's are created.
>>
>>So the question comes up, how do we tell when skb->mac.raw is pointing 
>>to an ethernet frame header and when it is pointing to something else?
>>    
>>
>Basically, the hardware header (ether frame) is resolved / appended
>in the ip_finish_output2() (for IPv4) or ip6_output_finish() (for IPv6),
>after POST_ROUTING.
>Thus, in the POST_ROUTING (or before the POST_ROUTING),
>hardware header (ether frame) is not available (in most cases).
>  
>
Thanks, for this, but the question is more complex.
conntrack only gets to inspect packets in PREROUTING and OUTPUT phases.
In this problem case the packet was originating from the local machine 
and so as you pointed out the mac info won't be setup until POSTROUTING.

Generally I am only interesting in collecting mac addresses in PREROUTING.
I suppose I need to know which phase of netfilter triggered the 
conntrack that triggered me. Until then I have stolen the ancient 
bridging check which makes sure that skb->mac.raw points to somewhere 
within skb, so I can tell it is at least a valid pointer.

Is there anyway to tell if skb>mac.raw it points to an ethernet mac 
address, or an X25 linklayer address, or appletalk, etc?
Having a valid pointer is one thing, but knowing what it points to is 
another.

Thanks

Amin