Re: [PATCH] remove overzealous checks in REJECT target]

[Carl-Daniel Hailfinger <c-d.hailfinger.kernel.2004@gmx.net>]

Harald Welte schrieb:
> On Fri, Dec 17, 2004 at 06:43:39AM +0100, Patrick McHardy wrote:
> 
>>Harald Welte wrote:
>>
>>
>>>Hi Patrick!
>>>
>>>I agree with Yasuyuki's proposed changes, do you already have this patch
>>>in your pending queue?
>>
>>I missed it, but the patch is wrong. We must return at least 8 byte of
>>protocol header, so the check can't be removed. The skb_header_pointer
>>part looks fine, I'm going to apply it after getting some sleep.
> 
> 
>>RFC1122: §3.2.2:
> 
> 
> Thanks for pointing this out.  I certainly read it a number of times
> before, but it slipped my mind temporarily.

Well, the kernel for sure doesn't care if netfilter isn't loaded. My
patch (and by consequence, Yasuyuki's patch) only tried to behave the
same as a kernel without netfilter enabled.

Hint: Try nmap "protocol scan" on a host without netfilter loaded. It
will happiliy reject packets which are too short. Then enable REJECT
for all IP protocols you don't want to support. And you'll see that
the too short packets will suddenly stay unanswered.

So we either break the standard or we don't, but breaking it only if
netfilter is not loaded doesn't sound like a sensible default to me.


Regards,
Carl-Daniel
-- 
http://www.hailfinger.org/