Subject: Re: [netfilter-core] [NETFILTER] Apply IPsec to ipt_REJECT packets

From: Patrick McHardy <[email-masked]>
Date: Tue, 23 Nov 2004 22:44:33 +0100

Herbert Xu wrote:

>On Tue, Nov 23, 2004 at 07:17:36PM +0100, Patrick McHardy wrote:
>  
>
>>The patch doesn't handle tcp resets sent in response to a forwarded packet.
>>I'll send a patch later tonight.
>>    
>>
>
>Isn't that handled by ip_forward itself?
>  
>
No. ip_forward handles the original packet, not the packet generated
by ipt_REJECT. RSTs generated in NF_IP_FORWARD are routed using
ip_route_input because they have a non-local source, so xfrm_route_forward
or xfrm_lookup needs to be called for them.

Regards
Patrick