
#-----------------------------------------------------------------------
# CHANGES
#-----------------------------------------------------------------------
#
# 2000-10-25  Jean-Sebastien Morisset <jsmoriss@mvlan.net>
#             Initial module written for v5.1.
#
#-----------------------------------------------------------------------
# MODULE CONFIGURATION
#-----------------------------------------------------------------------
#
#m# 123
#a# accept ignore
#i# cluster
#n# ping
#t# clients
#
#   |--------------------------------------------------------------------|
#d# Accept ping and traceroute from these hosts/networks (accepts are 
#d# logged) -- by default, ping and traceroute are denied. Use the ignore
#d# option to block a subset of the accept option. 
#d#
#d# Example:
#d#   accept-eth1-ping-clients = 
#d#   ignore-eth1-ping-clients = any/0 
#   |--------------------------------------------------------------------|
#
#-----------------------------------------------------------------------
# START OF MODULE CODE
#-----------------------------------------------------------------------

for action in ignore accept
do
	case $action in
		ignore)
			action_msg="Deny/Reject"
			action_in_jump="DENY"
			action_out_jump="REJECT"
			;;
		accept)
			action_msg="Accept"
			action_in_jump="ACCEPT"
			action_out_jump="ACCEPT"
			;;
	esac
	for host in `Option_Value $action $INTOPT ping clients`
	do
		echo "$action_msg $INTOPT $IPADDR ICMP Echo Reply <-> $host ICMP Echo Request $LOG_MSG"
		ipchains -A $INCHAIN  -j $action_in_jump  -p icmp -s $host echo-request -d $IPADDR $LOG
		ipchains -A $OUTCHAIN -j $action_out_jump -p icmp -s $IPADDR echo-reply -d $host   $LOG

		echo "$action_msg $INTOPT $IPADDR ICMP Destination Unreachable -> $host $LOG_MSG"
		ipchains -A $OUTCHAIN -j $action_out_jump -p icmp -s $IPADDR destination-unreachable -d $host $LOG
		
		echo "$action_msg $INTOPT $IPADDR ICMP Redirect <-> $host ICMP Redirect $LOG_MSG"
		ipchains -A $INCHAIN  -j $action_in_jump  -p icmp -s $host   redirect -d $IPADDR $LOG
		ipchains -A $OUTCHAIN -j $action_out_jump -p icmp -s $IPADDR redirect -d $host   $LOG

		echo "$action_msg $INTOPT $IPADDR ICMP Time Exceeded -> $host $LOG_MSG"
		ipchains -A $OUTCHAIN -j $action_out_jump -p icmp -s $IPADDR time-exceeded -d $host $LOG
	done
done
unset action action_msg action_in_jump action_out_jump host

if [ ! "$CLUSTER_NAME" -a "$MODE" -gt "0" ]
then
	echo "Accept $INTOPT $NETADDR ICMP Echo Request <-> $ANY ICMP Echo Reply $LOG_MSG"
	ipchains -A $INCHAIN  -j ACCEPT -p icmp -s $ANY    echo-reply   -d $NETADDR $LOG
	ipchains -A $OUTCHAIN -j ACCEPT -p icmp -s $NETADDR echo-request -d $ANY    $LOG

	# Type 3: A general error status message; a router along 
	# the path to the destination is unable to deliver the
	# packet to its next destination; used by traceroute.
	#
	echo "Accept $INTOPT $NETADDR <- $ANY ICMP Dest. Unreachable $LOG_MSG"
	ipchains -A $INCHAIN -j ACCEPT -p icmp -s $ANY destination-unreachable -d $NETADDR $LOG

	# One of the message sub-types, Fragmentation Needed, is used to 
	# negotiate packet fragment size. If we deny all outgoing type-3,
	# network performance could be affected.
	#
	echo "Accept $INTOPT $NETADDR ICMP Fragmentation Needed -> $ANY $LOG_MSG"
	ipchains -A $OUTCHAIN -j ACCEPT -p icmp -s $NETADDR fragmentation-needed -d $ANY $LOG

	echo "Accept $INTOPT $NETADDR ICMP Source Quench <-> $ANY ICMP Source Quench $LOG_MSG"
	ipchains -A $INCHAIN  -j ACCEPT -p icmp -s $ANY source-quench    -d $NETADDR $LOG
	ipchains -A $OUTCHAIN -j ACCEPT -p icmp -s $NETADDR source-quench -d $ANY    $LOG

	echo "Accept $INTOPT $NETADDR <- $ANY ICMP Time Exceeded $LOG_MSG"
	ipchains -A $INCHAIN  -j ACCEPT -p icmp -s $ANY time-exceeded -d $NETADDR $LOG

	echo "Accept $INTOPT $NETADDR ICMP Param. Problem <-> $ANY ICMP Param. Problem $LOG_MSG"
	ipchains -A $INCHAIN  -j ACCEPT -p icmp -s $ANY parameter-problem    -d $NETADDR $LOG
	ipchains -A $OUTCHAIN -j ACCEPT -p icmp -s $NETADDR parameter-problem -d $ANY    $LOG
fi

