Re: [PATCH 2.4] fix ipt_REJECT when used in OUTPUT

[Diadon <diadon@isfera.ru>]

That patch is not work, after patching the kernel problem is not 
disappeared!

Patch by Patrick is working fine and fix this problem


Harald Welte wrote:

>Hi Dave!
>
>Some people use REJECT in the OUTPUT chain (rejecting locally generated
>packets).  This didn't work anymore starting with some fixes we did in 2.4.22. 
>A dst_entry for a local source doesn't contain pmtu information - and
>thus the newly-created packet would instantly be dropped again.
>
>I'll send you a 2.6.x merge for this later.
>
>Please apply the following fix, thanks
>
>  
>
>------------------------------------------------------------------------
>
>diff -Nru --exclude .depend --exclude '*.o' --exclude '*.ko' --exclude '*.ver' --exclude '.*.flags' --exclude '*.orig' --exclude '*.rej' --exclude '*.cmd' --exclude '*.mod.c' --exclude '*~' linux-2.4.22/net/ipv4/netfilter/ipt_REJECT.c linux-2.4.22-rejectfix/net/ipv4/netfilter/ipt_REJECT.c
>--- linux-2.4.22/net/ipv4/netfilter/ipt_REJECT.c	2003-08-25 13:44:44.000000000 +0200
>+++ linux-2.4.22-rejectfix/net/ipv4/netfilter/ipt_REJECT.c	2003-09-21 16:39:25.000000000 +0200
>@@ -186,8 +186,8 @@
> 	nskb->nh.iph->check = ip_fast_csum((unsigned char *)nskb->nh.iph, 
> 					   nskb->nh.iph->ihl);
> 
>-	/* "Never happens" */
>-	if (nskb->len > nskb->dst->pmtu)
>+	/* dst->pmtu can be zero because it is not set for local dst's */
>+	if (nskb->dst->pmtu && nskb->len > nskb->dst->pmtu)
> 		goto free_nskb;
> 
> 	connection_attach(nskb, oldskb->nfct);
>  
>
>------------------------------------------------------------------------
>
>Scanned by evaliation version of Dr.Web antivirus Daemon 
>http://drweb.ru/unix/
>
>  
>