* change in behavior of OUTPUT chain reject rule in 2.6.19
@ 2006-12-15 15:23 Mike Accetta
0 siblings, 0 replies; 2+ messages in thread
From: Mike Accetta @ 2006-12-15 15:23 UTC (permalink / raw)
To: netfilter-devel
Between 2.6.18 and 2.6.19 (and 2.6.19.1) we've observed that a reject
rule on the OUTPUT chain no longer causes a connection attempt to abort
immediately with "Connection refused". As a specific example, this rule
iptables -A OUTPUT -p tcp --destination-port 23 \
--destination 10.0.20.1 -j REJECT --reject-with tcp-reset
will cause a telnet connection to 10.0.20.1 to fail immediately under
2.6.18 but will take minutes to timeout under 2.6.19. A "git bisect"
identifies change 9d02002d2dc2c7423e5891b97727fde4d667adf1 as the
culprit. The change description gives no hint that this effect was
intended. Is this a regression?
--
Mike Accetta
ECI Telecom Ltd.
Data Networking Division (previously Laurel Networks)
^ permalink raw reply [flat|nested] 2+ messages in thread
* change in behavior of OUTPUT chain reject rule in 2.6.19
@ 2006-12-15 5:36 Mike Accetta
0 siblings, 0 replies; 2+ messages in thread
From: Mike Accetta @ 2006-12-15 5:36 UTC (permalink / raw)
To: netfilter-devel
Between 2.6.18 and 2.6.19 (and 2.6.19.1) we've observed that a reject
rule on the OUTPUT chain no longer causes a connection attempt to abort
immediately with "Connection refused". As a specific example, this rule
iptables -A OUTPUT -p tcp --destination-port 23 \
--destination 10.0.20.1 -j REJECT --reject-with tcp-reset
will cause a telnet connection to 10.0.20.1 to fail immediately under
2.6.18 but will take minutes to timeout under 2.6.19. A "git bisect"
identifies change 9d02002d2dc2c7423e5891b97727fde4d667adf1 as the
culprit. The change description gives no hint that this effect was
intended. Is this a regression?
--
Mike Accetta
ECI Telecom Ltd.
Data Networking Division (previously Laurel Networks)
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2006-12-15 15:23 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-12-15 15:23 change in behavior of OUTPUT chain reject rule in 2.6.19 Mike Accetta
-- strict thread matches above, loose matches on Subject: below --
2006-12-15 5:36 Mike Accetta
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.