]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: ip6t_REJECT: skip checksum verification for outgoing ipv6 packets
authorStanislav Fomichev <stfomichev@yandex-team.ru>
Tue, 22 Oct 2013 12:43:23 +0000 (16:43 +0400)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 23 Oct 2013 09:20:00 +0000 (11:20 +0200)
commite57ab900604c5f5760b04c7702d02d2f0b7233cc
treec95066079a1cc1df42935b0c275e78eb9ec6aaee
parent68316d1655a47898c84e64a6378025555c15eeac
netfilter: ip6t_REJECT: skip checksum verification for outgoing ipv6 packets

Don't verify checksum for outgoing packets because checksum calculation
may be done by the device.

Without this patch:
$ ip6tables -I OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset
$ time telnet ipv6.google.com 80
Trying 2a00:1450:4010:c03::67...
telnet: Unable to connect to remote host: Connection timed out

real    0m7.201s
user    0m0.000s
sys     0m0.000s

With the patch applied:
$ ip6tables -I OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset
$ time telnet ipv6.google.com 80
Trying 2a00:1450:4010:c03::67...
telnet: Unable to connect to remote host: Connection refused

real    0m0.085s
user    0m0.000s
sys     0m0.000s

Signed-off-by: Stanislav Fomichev <stfomichev@yandex-team.ru>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv6/netfilter/ip6t_REJECT.c