change sk_buff iph saddr... how?

[Felipe Maya <fmay@xxxxxxxxxxxxxxx>]

Hello.

I'm trying to send a packet using other net device. I'm taking all
information of device, the IP header source address is changing, the
packet is checksumed, and the dst_entry is updated. Can any help me to
send a packet using other interface?...The next source is KERNEL BUG
result. 

struct sk_buff *nskb;
struct rtable *rt;
struct iphdr *iph = (*skb)->nh.iph;
struct flowi fl = { };
fl.oif = (*skb)->sk ? (*skb)->sk->sk_bound_dev_if : 0;
fl.nl_u.ip4_u.daddr = iph->daddr;
fl.nl_u.ip4_u.saddr = nsaddr;
fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
fl.proto = iph->protocol;

switch(iph->protocol){
	case IPPROTO_TCP:
		fl.fl_ip_sport = (*skb)->h.th->source;
		fl.fl_ip_dport = (*skb)->h.th->dest;
	break;
	case IPPROTO_UDP:
		fl.fl_ip_sport = (*skb)->h.uh->source;
		fl.fl_ip_dport = (*skb)->h.uh->dest;
	break;
}
			
if (!skb_make_writable(skb, sizeof(*skb)))
	return NF_STOLEN;
if (ip_route_output_key(&rt, &fl) != 0){
	DEBUGP("ip_route_output_key error\n");
	//ip_rt_put(rt);
	//dev_put(dev);
	return NF_STOLEN;
}
//xfrm_lookup((struct dst_entry **)&rt, &fl, NULL, 0);

dst_release((*skb)->dst);
(*skb)->dst = &rt->u.dst;

if ((*skb)->dst->error)
	return NF_STOLEN;

//if (!(IPCB(*skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
xfrm_decode_session(*skb, &fl, AF_INET) == 0)

if (xfrm_lookup(&(*skb)->dst, &fl, (*skb)->sk, 0))
	return NF_STOLEN;

iph->saddr = nsaddr;
iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
ip_send_check(iph);
if (skb_headroom(*skb) < (*skb)->dst->dev->hard_header_len) {
	struct sk_buff *pskb;
	pskb = skb_realloc_headroom(*skb,
				(*skb)->dst->dev->hard_header_len);
	if (!pskb) {
		return NF_STOLEN;
	}
	if ((*skb)->sk) skb_set_owner_w(pskb, (*skb)->sk);
		kfree_skb(*skb);
		*skb = pskb;
	}
}
return NF_ACCEPT;