diff options
author | Harald Welte <laforge@gnumonks.org> | 2003-05-24 11:44:18 +0000 |
---|---|---|
committer | Harald Welte <laforge@gnumonks.org> | 2003-05-24 11:44:18 +0000 |
commit | 5a52c517ebb2c7421f57b0f00f2de6697cdd7a9c (patch) | |
tree | 8509d79b3c4781322acf5dee727d5a0d5af5cdc9 | |
parent | 690a395725367c814ec20b5508a98eef9bea5bac (diff) |
finally commit the overly delayed RFC1812 admin prohibited option
-rw-r--r-- | INCOMPATIBILITIES | 6 | ||||
-rw-r--r-- | extensions/libipt_REJECT.c | 16 | ||||
-rw-r--r-- | iptables.8 | 7 |
3 files changed, 26 insertions, 3 deletions
diff --git a/INCOMPATIBILITIES b/INCOMPATIBILITIES new file mode 100644 index 00000000..fd695e1b --- /dev/null +++ b/INCOMPATIBILITIES @@ -0,0 +1,6 @@ +INCOMPATIBILITIES: + +- The REJECT target has an '--reject-with admin-prohib' option which used + with kernels that do not support it, will result in a plain DROP instead + of REJECT. Use with caution. + Kernels that do support it: diff --git a/extensions/libipt_REJECT.c b/extensions/libipt_REJECT.c index ba63a0aa..8170edd8 100644 --- a/extensions/libipt_REJECT.c +++ b/extensions/libipt_REJECT.c @@ -9,6 +9,16 @@ #include <iptables.h> #include <linux/netfilter_ipv4/ip_tables.h> #include <linux/netfilter_ipv4/ipt_REJECT.h> +#include <linux/version.h> + +/* If we are compiling against a kernel that does not support + * IPT_ICMP_ADMIN_PROHIBITED, we are emulating it. + * The result will be a plain DROP of the packet instead of + * reject. -- Maciej Soltysiak <solt@dns.toxicfilms.tv> + */ +#ifndef IPT_ICMP_ADMIN_PROHIBITED +#define IPT_ICMP_ADMIN_PROHIBITED IPT_TCP_RESET + 1 +#endif struct reject_names { const char *name; @@ -35,7 +45,9 @@ static const struct reject_names reject_table[] = { {"icmp-host-prohibited", "host-prohib", IPT_ICMP_HOST_PROHIBITED, "ICMP host prohibited"}, {"tcp-reset", "tcp-reset", - IPT_TCP_RESET, "TCP RST packet"} + IPT_TCP_RESET, "TCP RST packet"}, + {"icmp-admin-prohibited", "admin-prohib", + IPT_ICMP_ADMIN_PROHIBITED, "ICMP administratively prohibited (*)"} }; static void @@ -64,6 +76,8 @@ help(void) " a reply packet according to type:\n"); print_reject_types(); + + printf("(*) See man page or read the INCOMPATIBILITES file for compatibility issues.\n"); } static struct option opts[] = { @@ -864,8 +864,9 @@ The type given can be .BR icmp-host-unreachable , .BR icmp-port-unreachable , .BR icmp-proto-unreachable , -.BR "icmp-net-prohibited or" -.BR icmp-host-prohibited , +.BR icmp-net-prohibited , +.BR "icmp-host-prohibited or" +.BR "icmp-admin-prohibited (*)" which return the appropriate ICMP error message (\fBport-unreachable\fP is the default). The option .B tcp-reset @@ -874,6 +875,8 @@ TCP RST packet to be sent back. This is mainly useful for blocking .I ident (113/tcp) probes which frequently occur when sending mail to broken mail hosts (which won't accept your mail otherwise). +.TP +(*) Using icmp-admin-prohibited with kernels that do not support it will result in a plain DROP instead of REJECT .SS SNAT This target is only valid in the .B nat |