summaryrefslogtreecommitdiffstats
path: root/extensions
diff options
context:
space:
mode:
authorHarald Welte <laforge@gnumonks.org>2003-05-24 11:44:18 +0000
committerHarald Welte <laforge@gnumonks.org>2003-05-24 11:44:18 +0000
commit5a52c517ebb2c7421f57b0f00f2de6697cdd7a9c (patch)
tree8509d79b3c4781322acf5dee727d5a0d5af5cdc9 /extensions
parent690a395725367c814ec20b5508a98eef9bea5bac (diff)
finally commit the overly delayed RFC1812 admin prohibited option
Diffstat (limited to 'extensions')
-rw-r--r--extensions/libipt_REJECT.c16
1 files changed, 15 insertions, 1 deletions
diff --git a/extensions/libipt_REJECT.c b/extensions/libipt_REJECT.c
index ba63a0aa..8170edd8 100644
--- a/extensions/libipt_REJECT.c
+++ b/extensions/libipt_REJECT.c
@@ -9,6 +9,16 @@
#include <iptables.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv4/ipt_REJECT.h>
+#include <linux/version.h>
+
+/* If we are compiling against a kernel that does not support
+ * IPT_ICMP_ADMIN_PROHIBITED, we are emulating it.
+ * The result will be a plain DROP of the packet instead of
+ * reject. -- Maciej Soltysiak <solt@dns.toxicfilms.tv>
+ */
+#ifndef IPT_ICMP_ADMIN_PROHIBITED
+#define IPT_ICMP_ADMIN_PROHIBITED IPT_TCP_RESET + 1
+#endif
struct reject_names {
const char *name;
@@ -35,7 +45,9 @@ static const struct reject_names reject_table[] = {
{"icmp-host-prohibited", "host-prohib",
IPT_ICMP_HOST_PROHIBITED, "ICMP host prohibited"},
{"tcp-reset", "tcp-reset",
- IPT_TCP_RESET, "TCP RST packet"}
+ IPT_TCP_RESET, "TCP RST packet"},
+ {"icmp-admin-prohibited", "admin-prohib",
+ IPT_ICMP_ADMIN_PROHIBITED, "ICMP administratively prohibited (*)"}
};
static void
@@ -64,6 +76,8 @@ help(void)
" a reply packet according to type:\n");
print_reject_types();
+
+ printf("(*) See man page or read the INCOMPATIBILITES file for compatibility issues.\n");
}
static struct option opts[] = {