diff options
| author | Pablo Neira Ayuso | 2014-09-26 14:35:14 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso | 2014-10-02 18:29:57 +0200 |
| commit | 51b0a5d8c21a91801bbef9bcc8639dc0b206c6cd (patch) | |
| tree | 62255f89e7725a5173d4b4e4f002f114ad524dda /net/ipv4/netfilter/Makefile | |
| parent | ipv4: mentions skb_gro_postpull_rcsum() in inet_gro_receive() (diff) | |
| download | kernel-qcow2-linux-51b0a5d8c21a91801bbef9bcc8639dc0b206c6cd.tar.gz kernel-qcow2-linux-51b0a5d8c21a91801bbef9bcc8639dc0b206c6cd.tar.xz kernel-qcow2-linux-51b0a5d8c21a91801bbef9bcc8639dc0b206c6cd.zip | |
netfilter: nft_reject: introduce icmp code abstraction for inet and bridge
This patch introduces the NFT_REJECT_ICMPX_UNREACH type which provides
an abstraction to the ICMP and ICMPv6 codes that you can use from the
inet and bridge tables, they are:
* NFT_REJECT_ICMPX_NO_ROUTE: no route to host - network unreachable
* NFT_REJECT_ICMPX_PORT_UNREACH: port unreachable
* NFT_REJECT_ICMPX_HOST_UNREACH: host unreachable
* NFT_REJECT_ICMPX_ADMIN_PROHIBITED: administratevely prohibited
You can still use the specific codes when restricting the rule to match
the corresponding layer 3 protocol.
I decided to not overload the existing NFT_REJECT_ICMP_UNREACH to have
different semantics depending on the table family and to allow the user
to specify ICMP family specific codes if they restrict it to the
corresponding family.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv4/netfilter/Makefile')
0 files changed, 0 insertions, 0 deletions