netdev - Re: [Bugme-new] [Bug 7716] New: change in behavior of OUTPUT chain reject rule in 2.6.19?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20061219200758.64bf5a81.akpm@osdl.org>
Date:	Tue, 19 Dec 2006 20:07:58 -0800
From:	Andrew Morton <akpm@...l.org>
To:	"David S. Miller" <davem@...emloft.net>,
	Patrick McHardy <kaber@...sh.net>
Cc:	"bugme-daemon@...nel-bugs.osdl.org" 
	<bugme-daemon@...zilla.kernel.org>, netdev@...r.kernel.org,
	maccetta@...relnetworks.com
Subject: Re: [Bugme-new] [Bug 7716] New: change in behavior of OUTPUT chain
 reject rule in 2.6.19?

On Tue, 19 Dec 2006 19:58:14 -0800
bugme-daemon@...zilla.kernel.org wrote:

> http://bugzilla.kernel.org/show_bug.cgi?id=7716
> 
>            Summary: change in behavior of OUTPUT chain reject rule in
>                     2.6.19?
>     Kernel Version: 2.6.19
>             Status: NEW
>           Severity: normal
>              Owner: networking_netfilter-iptables@...nel-bugs.osdl.org
>          Submitter: maccetta@...relnetworks.com
> 
> 
> Between 2.6.18 and 2.6.19 (and 2.6.19.1) we've observed that a reject
> rule on the OUTPUT chain no longer causes a connection attempt to abort
> immediately with "Connection refused".  As a specific example, this rule
> 
> iptables -A  OUTPUT -p tcp --destination-port 23 \
>   --destination 10.0.20.1  -j REJECT --reject-with tcp-reset
> 
> will cause a telnet connection to 10.0.20.1 to fail immediately under
> 2.6.18 but will take minutes to timeout under 2.6.19.  A "git bisect"
> identifies change 9d02002d2dc2c7423e5891b97727fde4d667adf1 as the
> culprit.  The change description gives no hint that this effect was
> intended.  Is this a regression?
> 
> ------- You are receiving this mail because: -------
> You are on the CC list for the bug, or are watching someone who is.
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html