On Tue, Nov 23, 2004 at 10:44:33PM +0100, Patrick McHardy wrote:
>
> No. ip_forward handles the original packet, not the packet generated
> by ipt_REJECT. RSTs generated in NF_IP_FORWARD are routed using
> ip_route_input because they have a non-local source, so xfrm_route_forward
> or xfrm_lookup needs to be called for them.
You're absolutely right. How about this patch then?
Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Now I'm puzzled as to how I haven't noticed this behaviour before.
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
p
Description: Text document
|