William Tu <u9012...@gmail.com> wrote:
Not related to your patch specifically but:
> +static int prepare_ip6gre_xmit_ipv6(struct sk_buff *skb,
> + struct net_device *dev,
> + struct flowi6 *fl6, __u8 *dsfield,
> + int *encap_limit)
> +{
> + struct ipv6hdr *ipv6h = ipv6_hdr(skb);
> + struct ip6_tnl *t = netdev_priv(dev);
> + __u16 offset;
> +
> + offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
> + /* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
> +
> + if (offset > 0) {
> + struct ipv6_tlv_tnl_enc_lim *tel;
> +
> + tel = (struct ipv6_tlv_tnl_enc_lim
> *)&skb_network_header(skb)[offset];
> + if (tel->encap_limit == 0) {
> + icmpv6_send(skb, ICMPV6_PARAMPROB,
> + ICMPV6_HDR_FIELD, offset + 2);
Doing this from ndo_start_xmit is error prone, the address information
in the packet might have already been rewritten by netfilter postrouting
hooks.
So either we must find a way to never emit any error packets
at this late stage (i.e., catch this in upper layer before POST_ROUTING
hook, or, (only alternative I see) add nfct query calls into the icmp
send function to obtain the correct destination address (original
source address) from conntrack.
