[PATCH 2.4] netfilter ipt_REJECT: Add RFC1812 ICMP_PKT_FILTERED

From: Harald Welte (laforge@netfilter.org)
Date: Fri Jul 25 2003 - 15:51:11 EST


Hi Dave!

The seven patch set of bugfixes for 2.4 is now complete. Well, one more
thing, depending on the definition of 'bug' (since Marcelo only accepts
bug fixes from now on).

We now have a small patch that adds an ICMP type to the REJECT target.
But since before this patch, we don't fully comply with RFC1812, you
might also consider it as a bugfix.

Author: Maciej Soltysiak <solt@dns.toxicfilms.tv>

This patch adds support for the iptables '--reject-with admin-prohib'
option of the REJECT target, making it compliant with RFC 1812.

Please apply,

diff -Nru linux.bak/include/linux/netfilter_ipv4/ipt_REJECT.h linux/include/linux/netfilter_ipv4/ipt_REJECT.h
--- linux.bak/include/linux/netfilter_ipv4/ipt_REJECT.h 2003-04-08 20:21:22.000000000 +0200
+++ linux/include/linux/netfilter_ipv4/ipt_REJECT.h 2003-04-09 16:40:05.000000000 +0200
@@ -9,7 +9,8 @@
         IPT_ICMP_ECHOREPLY,
         IPT_ICMP_NET_PROHIBITED,
         IPT_ICMP_HOST_PROHIBITED,
- IPT_TCP_RESET
+ IPT_TCP_RESET,
+ IPT_ICMP_ADMIN_PROHIBITED
 };

 struct ipt_reject_info {
diff -Nru linux.bak/net/ipv4/netfilter/ipt_REJECT.c linux/net/ipv4/netfilter/ipt_REJECT.c
--- linux.bak/net/ipv4/netfilter/ipt_REJECT.c 2003-04-08 20:21:56.000000000 +0200
+++ linux/net/ipv4/netfilter/ipt_REJECT.c 2003-04-09 16:41:07.000000000 +0200
@@ -1,6 +1,7 @@
 /*
  * This is a module which is used for rejecting packets.
  * Added support for customized reject packets (Jozsef Kadlecsik).
+ * Added support for ICMP type-3-code-13 (Maciej Soltysiak). [RFC 1812]
  */
 #include <linux/config.h>
 #include <linux/module.h>
@@ -330,6 +331,9 @@
         case IPT_ICMP_HOST_PROHIBITED:
                     send_unreach(*pskb, ICMP_HOST_ANO);
                     break;
+ case IPT_ICMP_ADMIN_PROHIBITED:
+ send_unreach(*pskb, ICMP_PKT_FILTERED);
+ break;
         case IPT_TCP_RESET:
                 send_reset(*pskb, hooknum == NF_IP_LOCAL_IN);
         case IPT_ICMP_ECHOREPLY:

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie


- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Thu Jul 31 2003 - 22:00:27 EST