On Tue, Mar 15, 2005 at 09:48:53PM +0100, Patrick McHardy wrote:
>
> Ok. I can't see any different reason to keep it, so go ahead. I'll take
> care of the xrlim stuff later.
Great. Here is the patch that makes ipt_REJECT use icmp_send again.
We've gone full circle :)
As it is ipt_REJECT doesn't work at all with IPsec. Despite my efforts
previously in making the policy lookups work there I neglected to change
the final call to dst_output so the policy lookup is useless.
ipt_REJECT also had a number of deviations from icmp_send which seems to
be unjustified. For examples it ignored source routing IP options.
There was a bug in icmp_send too :) It didn't set the ICMP type/code
values for the policy lookup.
Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
I compared the two functions line-by-line to make sure that there
weren't any subtle differences. Please double check this in case
I overlooked something important.
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
xfrm-18
Description: Text document
|