TEE broken in 3.6

[Torsten Luettgert <ml-netfilter@enda.eu>]

Hi,

today, I found that the TEE target doesn't work any longer in 3.6 and
following kernels. The problem is that it tries to ARP-lookup the
original destination address of the forwarded packet, not the address
of the gateway.

I git bisected and found that this commit broke it:

commit f8126f1d5136be1ca1a3536d43ad7a710b5620f8
Author: David S. Miller <davem@davemloft.net>
Date:   Fri Jul 13 05:03:45 2012 -0700

    ipv4: Adjust semantics of rt->rt_gateway.
    
    In order to allow prefixed routes, we have to adjust how rt_gateway
    is set and interpreted.
    
    The new interpretation is:
    
    1) rt_gateway == 0, destination is on-link, nexthop is iph->daddr
    
    2) rt_gateway != 0, destination requires a nexthop gateway
    
    Abstract the fetching of the proper nexthop value using a new
    inline helper, rt_nexthop(), as suggested by Joe Perches.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Tested-by: Vijay Subramanian <subramanian.vijay@gmail.com>

which seems plausible. I'm not versed enough in netfilter/routing code
to fix it myself. Could any of you wizards help?

Thanks,
Torsten