diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-09-26 14:35:14 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-10-02 18:29:57 +0200 |
commit | 51b0a5d8c21a91801bbef9bcc8639dc0b206c6cd (patch) | |
tree | 62255f89e7725a5173d4b4e4f002f114ad524dda /net/ipv6 | |
parent | 2c804d0f8fc7799981d9fdd8c88653541b28c1a7 (diff) | |
download | op-kernel-dev-51b0a5d8c21a91801bbef9bcc8639dc0b206c6cd.zip op-kernel-dev-51b0a5d8c21a91801bbef9bcc8639dc0b206c6cd.tar.gz |
netfilter: nft_reject: introduce icmp code abstraction for inet and bridge
This patch introduces the NFT_REJECT_ICMPX_UNREACH type which provides
an abstraction to the ICMP and ICMPv6 codes that you can use from the
inet and bridge tables, they are:
* NFT_REJECT_ICMPX_NO_ROUTE: no route to host - network unreachable
* NFT_REJECT_ICMPX_PORT_UNREACH: port unreachable
* NFT_REJECT_ICMPX_HOST_UNREACH: host unreachable
* NFT_REJECT_ICMPX_ADMIN_PROHIBITED: administratevely prohibited
You can still use the specific codes when restricting the rule to match
the corresponding layer 3 protocol.
I decided to not overload the existing NFT_REJECT_ICMP_UNREACH to have
different semantics depending on the table family and to allow the user
to specify ICMP family specific codes if they restrict it to the
corresponding family.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv6')
0 files changed, 0 insertions, 0 deletions