From 987402dc612154c8efacca94900bd7a8b5c6f150 Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Fri, 2 Apr 2010 16:59:13 +0200 Subject: [PATCH] xt_TEE: do not retain iif and mark on cloned packet Patrick McHardy explains in [1] that locally-generated packets (such as the clones xt_TEE will create) usually start with no iif and no mark value, and even if cloned packets are a little more special than locally-generated ones, let's do it that way. [1] http://marc.info/?l=netfilter-devel&m=127012289008156&w=2 --- doc/changelog.txt | 1 + extensions/xt_TEE.c | 13 ------------- 2 files changed, 1 insertion(+), 13 deletions(-) diff --git a/doc/changelog.txt b/doc/changelog.txt index 9f40d1f..556e4f0 100644 --- a/doc/changelog.txt +++ b/doc/changelog.txt @@ -6,6 +6,7 @@ HEAD - TEE: set dont-fragment on cloned packets - TEE: free skb when route lookup failed - TEE: do not limit use to mangle table +- TEE: do not retain iif and mark on cloned packet Xtables-addons 1.24 (March 17 2010) diff --git a/extensions/xt_TEE.c b/extensions/xt_TEE.c index 4614a48..af5173f 100644 --- a/extensions/xt_TEE.c +++ b/extensions/xt_TEE.c @@ -60,12 +60,6 @@ tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info) struct flowi fl; memset(&fl, 0, sizeof(fl)); - fl.iif = skb_ifindex(skb); -#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 19) - fl.nl_u.ip4_u.fwmark = skb_nfmark(skb); -#else - fl.mark = skb_nfmark(skb); -#endif fl.nl_u.ip4_u.daddr = info->gw.ip; fl.nl_u.ip4_u.tos = RT_TOS(iph->tos); fl.nl_u.ip4_u.scope = RT_SCOPE_UNIVERSE; @@ -231,13 +225,6 @@ tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info) struct flowi fl; memset(&fl, 0, sizeof(fl)); - fl.iif = skb_ifindex(skb); - /* No mark in flowi before 2.6.19 */ -#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 19) - fl.nl_u.ip6_u.fwmark = skb_nfmark(skb); -#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 20) - fl.mark = skb_nfmark(skb); -#endif fl.nl_u.ip6_u.daddr = info->gw.in6; fl.nl_u.ip6_u.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) | (iph->flow_lbl[1] << 8) | iph->flow_lbl[2];