lkml.org 
[lkml]   [2003]   [Jul]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH 2.4] netfilter ipt_REJECT: Add RFC1812 ICMP_PKT_FILTERED
Hi Dave!

The seven patch set of bugfixes for 2.4 is now complete. Well, one more
thing, depending on the definition of 'bug' (since Marcelo only accepts
bug fixes from now on).

We now have a small patch that adds an ICMP type to the REJECT target.
But since before this patch, we don't fully comply with RFC1812, you
might also consider it as a bugfix.


Author: Maciej Soltysiak <solt@dns.toxicfilms.tv>

This patch adds support for the iptables '--reject-with admin-prohib'
option of the REJECT target, making it compliant with RFC 1812.


Please apply,


diff -Nru linux.bak/include/linux/netfilter_ipv4/ipt_REJECT.h linux/include/linux/netfilter_ipv4/ipt_REJECT.h
--- linux.bak/include/linux/netfilter_ipv4/ipt_REJECT.h 2003-04-08 20:21:22.000000000 +0200
+++ linux/include/linux/netfilter_ipv4/ipt_REJECT.h 2003-04-09 16:40:05.000000000 +0200
@@ -9,7 +9,8 @@
IPT_ICMP_ECHOREPLY,
IPT_ICMP_NET_PROHIBITED,
IPT_ICMP_HOST_PROHIBITED,
- IPT_TCP_RESET
+ IPT_TCP_RESET,
+ IPT_ICMP_ADMIN_PROHIBITED
};

struct ipt_reject_info {
diff -Nru linux.bak/net/ipv4/netfilter/ipt_REJECT.c linux/net/ipv4/netfilter/ipt_REJECT.c
--- linux.bak/net/ipv4/netfilter/ipt_REJECT.c 2003-04-08 20:21:56.000000000 +0200
+++ linux/net/ipv4/netfilter/ipt_REJECT.c 2003-04-09 16:41:07.000000000 +0200
@@ -1,6 +1,7 @@
/*
* This is a module which is used for rejecting packets.
* Added support for customized reject packets (Jozsef Kadlecsik).
+ * Added support for ICMP type-3-code-13 (Maciej Soltysiak). [RFC 1812]
*/
#include <linux/config.h>
#include <linux/module.h>
@@ -330,6 +331,9 @@
case IPT_ICMP_HOST_PROHIBITED:
send_unreach(*pskb, ICMP_HOST_ANO);
break;
+ case IPT_ICMP_ADMIN_PROHIBITED:
+ send_unreach(*pskb, ICMP_PKT_FILTERED);
+ break;
case IPT_TCP_RESET:
send_reset(*pskb, hooknum == NF_IP_LOCAL_IN);
case IPT_ICMP_ECHOREPLY:
--
- Harald Welte <laforge@netfilter.org> http://www.netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 13:47    [W:0.058 / U:0.616 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site