From: Patrick McHardy <kaber@trash.net>
To: JP Abgrall <jpa@google.com>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: Force socket error on iptables reject with icmp semantics?
Date: Tue, 24 May 2011 09:01:47 +0200 [thread overview]
Message-ID: <4DDB57DB.8050004@trash.net> (raw)
In-Reply-To: <BANLkTi=APDmR7c8eqVySKofXx_wMtgPGOw@mail.gmail.com>
On 24.05.2011 01:16, JP Abgrall wrote:
> Before I go bug the kernel people, I'd like to know if this seems
> reasonable from a netfilter perspective.
>
>>From e8b45cfd66ccc1be0bc406fc9662f0f1e7a94283 Mon Sep 17 00:00:00 2001
> From: JP Abgrall <jpa@google.com>
> Date: Thu, 19 May 2011 19:30:02 -0700
> Subject: [PATCH] netfilter: have ip*t REJECT set the sock err when an
> icmp is to be sent
>
> Allow the REJECT --reject-with icmp*blabla to also set the matching error
> locally on the socket affected by the reject.
> This allows the process to see an error as if it received it via ICMP.
> It avoids the local process who's packet is rejected to have to wait
> for a pseudo-eternity until some timeout kicks in.
The interpretation and handling of the ICMP errors is up to the higher
layer protocols. So doing this in the REJECT target is not a good idea.
Unless there's something wrong in your setup, the ICMP message should
be received by the socket anyways.
next prev parent reply other threads:[~2011-05-24 7:02 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-05-23 23:16 Force socket error on iptables reject with icmp semantics? JP Abgrall
2011-05-24 7:01 ` Patrick McHardy [this message]
2011-05-25 1:57 ` JP Abgrall
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4DDB57DB.8050004@trash.net \
--to=kaber@trash.net \
--cc=jpa@google.com \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.