Replace send_unreach with icmp_send

[Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>]

On Tue, Mar 15, 2005 at 08:02:26PM +0100, Patrick McHardy wrote:
> 
> I would prefer to keep it seperately. I have planned to remove xrlim
> from ipt_REJECT so it behaves similar for TCP and ICMP. Limits should
> then be handled by the limit match. This can't be done if we switch to
> icmp_send().

Well it isn't terribly difficult to create a new version of icmp_send
that does xrlim conditionally.  icmp_send/ipt_REJECT can then call that
function.

The main reason I'm looking at getting rid of send_unreach is because
having two implementations of the same code often leads to bugs.  In
fact, as it is there are multiple IPsec-related bugs in the ipt_REJECT
code.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt