Re: ICMP dest-unreach in SYN_* states of TCP

[Jamie Lokier]

Taral wrote:
> > But generally: linux will send fake RSTs only via my corpse.
> > If firewalls will start to use RST instead of ICMP, we have to
> > ignore RST in established state. Is it good? The question is rethoric.
> 
> Sorry to disappoint you, but I thought the firewalls sent RST if you
> specified 'reject' on a TCP packet...

Not unless the kernel's changed in the last few months it doesn't.
A quick peek at ip_input.c:

        if (fwres == FW_REJECT) {
                icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
                goto drop;
        }

enjoy,
-- Jamie
-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to [EMAIL PROTECTED]