[PATCH 2.4] fix ipt_REJECT when used in OUTPUT

Harald Welte
2003-09-21T19:51:16Z

[-- Attachment #1.1: Type: text/plain, Size: 764 bytes --]

Hi Dave!

Some people use REJECT in the OUTPUT chain (rejecting locally generated
packets). This didn't work anymore starting with some fixes we did in 2.4.22.
A dst_entry for a local source doesn't contain pmtu information - and
thus the newly-created packet would instantly be dropped again.

I'll send you a 2.6.x merge for this later.

Please apply the following fix, thanks

--
- Harald Welte <laforge@netfilter.org> http://www.netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie

[-- Attachment #1.2: 75_REJECT_localpmtu-fix.patch --]
[-- Type: text/plain, Size: 847 bytes --]

diff -Nru --exclude .depend --exclude '*.o' --exclude '*.ko' --exclude '*.ver' --exclude '.*.flags' --exclude '*.orig' --exclude '*.rej' --exclude '*.cmd' --exclude '*.mod.c' --exclude '*~' linux-2.4.22/net/ipv4/netfilter/ipt_REJECT.c linux-2.4.22-rejectfix/net/ipv4/netfilter/ipt_REJECT.c
--- linux-2.4.22/net/ipv4/netfilter/ipt_REJECT.c 2003-08-25 13:44:44.000000000 +0200
+++ linux-2.4.22-rejectfix/net/ipv4/netfilter/ipt_REJECT.c 2003-09-21 16:39:25.000000000 +0200
@@ -186,8 +186,8 @@
nskb->nh.iph->check = ip_fast_csum((unsigned char *)nskb->nh.iph,
nskb->nh.iph->ihl);

- /* "Never happens" */
- if (nskb->len > nskb->dst->pmtu)
+ /* dst->pmtu can be zero because it is not set for local dst's */
+ if (nskb->dst->pmtu && nskb->len > nskb->dst->pmtu)
goto free_nskb;

connection_attach(nskb, oldskb->nfct);

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]