Re: xt_connlimit 20070707 kernel

[Patrick McHardy <kaber@trash.net>]

Yasuyuki KOZAKAI wrote:
> From: Jan Engelhardt <jengelh@computergmbh.de>
> Date: Mon, 9 Jul 2007 17:10:52 +0200 (CEST)
> 
> 
>>+	} else {
>>+		struct nf_conntrack_l3proto *l3proto;
>>+		struct nf_conntrack_l4proto *l4proto;
>>+
>>+		l3proto = __nf_ct_l3proto_find(match->family);
>>+		if (l3proto == NULL)
>>+			goto hotdrop;
>>+		l4proto = __nf_ct_l4proto_find(match->family, match->proto);
>>+		if (l4proto == NULL)
>>+			goto hotdrop;
>>+		if (nf_ct_get_tuple(skb, 0, 0, match->family, match->proto,
>>+		    &tuple, NULL, NULL) != 0)
>>+			goto hotdrop;
> 
> 
> The second argument is the offset to network protocol header,
> skb_network_offset(skb) (it is 0 in most cases, but it is more logical).
> 
> The third argument is the offset to the transport protocol header. In the case
> of IPv4, you can use ip_hdrlen(). About IPv6, you can use
> nf_ct_ipv6_skip_exthdr(), but you also need to export the symbol of
> nf_ct_ipv6_skip_exthdr().


Good point. Another question: Jan, why are you looking up l3proto and
l4proto and don't use them for anything? This doesn't look like you
even tested it ..