Currently, there is some inconsistency about which
packets go through the output INET firewall code, and how often.
I propose to make the rule the following:
***
Each IP datagram goes through the output INET firewall code
exactly once. Fragmentation happens *after* the output code has
said 'YES'. Further, the whole output datagram will be provided
to the output firewall code.
***
I realize that some people may have thought that the above description
describes how the code works, but there are various odd paths
involving large PINGs and general fragmentation.
Are there any arguments for a different description?
Philip
-- Philip Gladstone +1 617 487 7700 Raptor Systems, Waltham, MA http://www.raptor.com/