• Stanislav Fomichev's avatar
    netfilter: ip6t_REJECT: skip checksum verification for outgoing ipv6 packets · f2020b27
    Stanislav Fomichev authored
    Don't verify checksum for outgoing packets because checksum calculation
    may be done by the device.
    
    Without this patch:
    $ ip6tables -I OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset
    $ time telnet ipv6.google.com 80
    Trying 2a00:1450:4010:c03::67...
    telnet: Unable to connect to remote host: Connection timed out
    
    real    0m7.201s
    user    0m0.000s
    sys     0m0.000s
    
    With the patch applied:
    $ ip6tables -I OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset
    $ time telnet ipv6.google.com 80
    Trying 2a00:1450:4010:c03::67...
    telnet: Unable to connect to remote host: Connection refused
    
    real    0m0.085s
    user    0m0.000s
    sys     0m0.000s
    Signed-off-by: default avatarStanislav Fomichev <stfomichev@yandex-team.ru>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    f2020b27
ip6t_REJECT.c 7.47 KB