* [PATCH 2.4] netfilter ipt_REJECT: Add RFC1812 ICMP_PKT_FILTERED
@ 2003-07-25 20:51 Harald Welte
2003-07-25 21:16 ` David S. Miller
0 siblings, 1 reply; 2+ messages in thread
From: Harald Welte @ 2003-07-25 20:51 UTC (permalink / raw)
To: David Miller; +Cc: Netfilter Development Mailinglist, Linux Kernel Mailinglist
[-- Attachment #1: Type: text/plain, Size: 2288 bytes --]
Hi Dave!
The seven patch set of bugfixes for 2.4 is now complete. Well, one more
thing, depending on the definition of 'bug' (since Marcelo only accepts
bug fixes from now on).
We now have a small patch that adds an ICMP type to the REJECT target.
But since before this patch, we don't fully comply with RFC1812, you
might also consider it as a bugfix.
Author: Maciej Soltysiak <solt@dns.toxicfilms.tv>
This patch adds support for the iptables '--reject-with admin-prohib'
option of the REJECT target, making it compliant with RFC 1812.
Please apply,
diff -Nru linux.bak/include/linux/netfilter_ipv4/ipt_REJECT.h linux/include/linux/netfilter_ipv4/ipt_REJECT.h
--- linux.bak/include/linux/netfilter_ipv4/ipt_REJECT.h 2003-04-08 20:21:22.000000000 +0200
+++ linux/include/linux/netfilter_ipv4/ipt_REJECT.h 2003-04-09 16:40:05.000000000 +0200
@@ -9,7 +9,8 @@
IPT_ICMP_ECHOREPLY,
IPT_ICMP_NET_PROHIBITED,
IPT_ICMP_HOST_PROHIBITED,
- IPT_TCP_RESET
+ IPT_TCP_RESET,
+ IPT_ICMP_ADMIN_PROHIBITED
};
struct ipt_reject_info {
diff -Nru linux.bak/net/ipv4/netfilter/ipt_REJECT.c linux/net/ipv4/netfilter/ipt_REJECT.c
--- linux.bak/net/ipv4/netfilter/ipt_REJECT.c 2003-04-08 20:21:56.000000000 +0200
+++ linux/net/ipv4/netfilter/ipt_REJECT.c 2003-04-09 16:41:07.000000000 +0200
@@ -1,6 +1,7 @@
/*
* This is a module which is used for rejecting packets.
* Added support for customized reject packets (Jozsef Kadlecsik).
+ * Added support for ICMP type-3-code-13 (Maciej Soltysiak). [RFC 1812]
*/
#include <linux/config.h>
#include <linux/module.h>
@@ -330,6 +331,9 @@
case IPT_ICMP_HOST_PROHIBITED:
send_unreach(*pskb, ICMP_HOST_ANO);
break;
+ case IPT_ICMP_ADMIN_PROHIBITED:
+ send_unreach(*pskb, ICMP_PKT_FILTERED);
+ break;
case IPT_TCP_RESET:
send_reset(*pskb, hooknum == NF_IP_LOCAL_IN);
case IPT_ICMP_ECHOREPLY:
--
- Harald Welte <laforge@netfilter.org> http://www.netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2003-07-25 21:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2003-07-25 20:51 [PATCH 2.4] netfilter ipt_REJECT: Add RFC1812 ICMP_PKT_FILTERED Harald Welte
2003-07-25 21:16 ` David S. Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).