ip6tables - --reject-with tcp-reset does not work correctly in chain OUTPUT
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
Fix Released
|
Medium
|
Unassigned | ||
Saucy |
Won't Fix
|
Undecided
|
Unassigned | ||
Trusty |
Fix Released
|
Undecided
|
Unassigned | ||
Utopic |
Fix Released
|
Medium
|
Unassigned |
Bug Description
Hello,
We use:
Description: Ubuntu 12.04.3 LTS
Release: 12.04
kernel 3.2.2 (checked also 3.8* and 3.10.5-
iptables=
and ipv6
We noticed that --reject-with tcp-reset works 7 seconds:
ip6tables -I OUTPUT -p tcp --dport 10001 -j REJECT --reject-with tcp-reset
such rule
ip6tables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp anywhere anywhere tcp dpt:10001 reject-with tcp-reset
time telnet <ourlovelyipv6o
Trying 2a02:6b8:0:c10*...
telnet: Unable to connect to remote host: Connection timed out
real 0m7.012s
user 0m0.000s
sys 0m0.000s
Rule works:
ip6tables -vL
Chain INPUT (policy ACCEPT 506 packets, 49495 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 346 packets, 37392 bytes)
pkts bytes target prot opt in out source destination
3 216 REJECT tcp any any anywhere anywhere tcp dpt:10001 reject-with tcp-reset
Tcpdump is empty. Packet counter increases. All well.
But it works 7 seconds
iptables does the same within 0.005s
I think this is a bug.
Thank you.
Have a nice day.
---
AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.25.
ApportVersion: 2.0.1-0ubuntu17.1
Architecture: amd64
ArecordDevices:
**** List of CAPTURE Hardware Devices ****
card 0: PCH [HDA Intel PCH], device 0: ALC269VC Analog [ALC269VC Analog]
Subdevices: 1/1
Subdevice #0: subdevice #0
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/
CRDA:
country RU:
(2402 - 2482 @ 40), (N/A, 20)
(5735 - 5835 @ 20), (N/A, 30)
Card0.Amixer.info:
Card hw:0 'PCH'/'HDA Intel PCH at 0xf0700000 irq 50'
Mixer name : 'Intel PantherPoint HDMI'
Components : 'HDA:10ec0269,
Controls : 24
Simple ctrls : 10
DistroRelease: Ubuntu 12.04
EcryptfsInUse: Yes
HibernationDevice: RESUME=
InstallationMedia: Ubuntu 12.04.2 LTS "Precise Pangolin" - Release amd64 (20130213)
Lsusb:
Bus 001 Device 002: ID 8087:0024 Intel Corp. Integrated Rate Matching Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 003 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 004: ID 2232:1024
MachineType: SAMSUNG ELECTRONICS CO., LTD. 900X3C/
MarkForUpload: True
Package: linux (not installed)
ProcEnviron:
TERM=xterm
PATH=(custom, no user)
LANG=en_US.UTF-8
SHELL=/bin/bash
ProcFB: 0 inteldrmfb
ProcKernelCmdLine: BOOT_IMAGE=
ProcVersionSign
RelatedPackageV
linux-
linux-
linux-firmware 1.79.1
Tags: precise
Uname: Linux 3.5.0-26-generic x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo
dmi.bios.date: 09/19/2012
dmi.bios.vendor: Phoenix Technologies Ltd.
dmi.bios.version: P02ABK
dmi.board.
dmi.board.name: NP900X3C-A03RU
dmi.board.vendor: SAMSUNG ELECTRONICS CO., LTD.
dmi.board.version: FAB1
dmi.chassis.
dmi.chassis.type: 9
dmi.chassis.vendor: SAMSUNG ELECTRONICS CO., LTD.
dmi.chassis.
dmi.modalias: dmi:bvnPhoenixT
dmi.product.name: 900X3C/
dmi.product.
dmi.sys.vendor: SAMSUNG ELECTRONICS CO., LTD.
tags: | added: precise |
Changed in linux (Ubuntu): | |
importance: | Undecided → Medium |
https:/ /git.kernel. org/cgit/ linux/kernel/ git/pablo/ nf-next. git/commit/ ?id=f2020b27be9 4222eb25c39ff46 eb9917cb92897b
fixed