From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jens Hektor Subject: [PATCH] [RESEND] RFC 1812 recommended reject codes Was:[ANNOUNCE] Current netfilter/iptables development Date: Fri, 10 Jan 2003 20:26:28 +0100 Sender: netfilter-devel-admin@lists.netfilter.org Message-ID: <3E1F1E64.4060404@rz.rwth-aachen.de> References: <3E1BD5E0.2030006@rz.rwth-aachen.de> <20030110130924.GP1353@sunbeam.de.gnumonks.org> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="Boundary_(ID_yF0k/e34im0CP81hcTRLbQ)" Return-path: In-reply-to: <20030110130924.GP1353@sunbeam.de.gnumonks.org> To: netfilter-devel@lists.netfilter.org Errors-To: netfilter-devel-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Unsubscribe: , List-Archive: List-Id: netfilter-devel.vger.kernel.org This is a multi-part message in MIME format. --Boundary_(ID_yF0k/e34im0CP81hcTRLbQ) Content-type: text/plain; charset=us-ascii; format=flowed Content-transfer-encoding: 7BIT Hi, I am submitting the patches hoping they are in the correct form and get into the queue for 2.4.21. Credits to Maciej Soltysiak who worked on the same problem also. Best regards, Jens Hektor -- Jens Hektor, RWTH Aachen, Rechenzentrum, Seffenter Weg 23, 52074 Aachen Computing Center, Aachen University, network operation & security mailto:hektor@RZ.RWTH-Aachen.DE, Tel.: +49 241 80 29206, Raum: 2.35 --Boundary_(ID_yF0k/e34im0CP81hcTRLbQ) Content-type: text/plain; name=fix-RFC-1812-ipt_REJECT-kernel.patch Content-transfer-encoding: 7BIT Content-disposition: inline; filename=fix-RFC-1812-ipt_REJECT-kernel.patch --- linux-2.4.20/net/ipv4/netfilter/ipt_REJECT.c.orig 2002-11-29 07:03:27.000000000 +0100 +++ linux-2.4.20/net/ipv4/netfilter/ipt_REJECT.c 2002-11-29 07:07:14.000000000 +0100 @@ -308,6 +308,9 @@ case IPT_ICMP_HOST_PROHIBITED: send_unreach(*pskb, ICMP_HOST_ANO); break; + case IPT_ICMP_ADMIN_PROHIBITED: + send_unreach(*pskb, ICMP_PKT_FILTERED); + break; case IPT_TCP_RESET: send_reset(*pskb, hooknum == NF_IP_LOCAL_IN); case IPT_ICMP_ECHOREPLY: --- linux-2.4.20/include/linux/netfilter_ipv4/ipt_REJECT.h.orig 2002-11-29 07:32:28.000000000 +0100 +++ linux-2.4.20/include/linux/netfilter_ipv4/ipt_REJECT.h 2002-11-29 19:42:47.000000000 +0100 @@ -9,7 +9,8 @@ IPT_ICMP_ECHOREPLY, IPT_ICMP_NET_PROHIBITED, IPT_ICMP_HOST_PROHIBITED, - IPT_TCP_RESET + IPT_TCP_RESET, + IPT_ICMP_ADMIN_PROHIBITED }; struct ipt_reject_info { --Boundary_(ID_yF0k/e34im0CP81hcTRLbQ) Content-type: text/plain; name=fix-RFC-1812-ipt_REJECT-kernel.patch.help Content-transfer-encoding: 7BIT Content-disposition: inline; filename=fix-RFC-1812-ipt_REJECT-kernel.patch.help Author: Jens Hektor Status: Trivial. Adds the possibility of sending RFC 1812 recommended reject codes into the kernel code. (ICMP destination unreachable, code 13, see RFC 1812, p 81) Backward compatibility with older iptables versions preserved by appending to the enum. --Boundary_(ID_yF0k/e34im0CP81hcTRLbQ) Content-type: text/plain; name=fix-RFC-1812-libipt_REJECT.patch Content-transfer-encoding: 7BIT Content-disposition: inline; filename=fix-RFC-1812-libipt_REJECT.patch --- iptables-1.2.7a/extensions/libipt_REJECT.c.orig 2002-11-29 19:38:01.000000000 +0100 +++ iptables-1.2.7a/extensions/libipt_REJECT.c 2002-12-02 06:51:31.000000000 +0100 @@ -7,6 +7,8 @@ #include #include #include +#include +#include #include #include @@ -35,9 +37,17 @@ {"icmp-host-prohibited", "host-prohib", IPT_ICMP_HOST_PROHIBITED, "ICMP host prohibited"}, {"tcp-reset", "tcp-reset", - IPT_TCP_RESET, "TCP RST packet"} + IPT_TCP_RESET, "TCP RST packet"}, +/* #if to fix compiletime compatibility, adjust version to reflect the include of the kernel patch into the main tree */ +#if ((LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,20) && LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0))||LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,99)) + {"icmp-admin-prohibited", "admin-prohib", + IPT_ICMP_ADMIN_PROHIBITED, "ICMP administratively prohibited"} +#endif }; +static +int icmp_admin_prohib_enabled = 0 ; + static void print_reject_types() { @@ -46,8 +56,10 @@ printf("Valid reject types:\n"); for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) { - printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc); - printf(" %-25s\talias\n", reject_table[i].alias); + if ((strcmp ( reject_table[i].name, "icmp-admin-prohibited" ) == 0) && icmp_admin_prohib_enabled) { + printf(" %-25s\t%s\n", reject_table[i].name, reject_table[i].desc); + printf(" %-25s\talias\n", reject_table[i].alias); + } } printf("\n"); } @@ -103,8 +115,13 @@ for (i = 0; i < limit; i++) { if ((strncasecmp(reject_table[i].name, optarg, strlen(optarg)) == 0) || (strncasecmp(reject_table[i].alias, optarg, strlen(optarg)) == 0)) { - reject->with = reject_table[i].with; - return 1; + if (reject_table[i].with==IPT_ICMP_ADMIN_PROHIBITED && !icmp_admin_prohib_enabled) { + exit_error(PARAMETER_PROBLEM, + "icmp-admin-prohibited not with this kernel version"); + } else { + reject->with = reject_table[i].with; + return 1; + } } } /* This due to be dropped late in 2.4 pre-release cycle --RR */ @@ -174,5 +191,15 @@ void _init(void) { + struct utsname buf ; + int a, b, c ; + + /* This is to fix run-time compatibility with kernels that + are not compatible with this version of iptables */ + uname(&buf); + sscanf (buf.release, "%d.%d.%d", &a, &b, &c); + if ((a==2 && b==4 && c>=20) || (a==2 && b==5 && c>=99 )) + icmp_admin_prohib_enabled = 1; + register_target(&reject); } --Boundary_(ID_yF0k/e34im0CP81hcTRLbQ) Content-type: text/plain; name=fix-RFC-1812-libipt_REJECT.patch.help Content-transfer-encoding: 7BIT Content-disposition: inline; filename=fix-RFC-1812-libipt_REJECT.patch.help Author: Jens Hektor Status: It Works For Me. This patch adds a new option for --reject-with, namely "icmp-admin-prohibited" or short "admin-prohib" to enable RFC 1812 compatible reject codes. While the actual code to enable this feature is trivial most of the code in this patch is to preserve backward compatibility of a new iptables version running or compiling on an older kernel. Assumption in this patch is that 2.4.21 and 2.5.99 support this feature already in the kernel. --Boundary_(ID_yF0k/e34im0CP81hcTRLbQ)--