Pablo Neira Ayuso 51b0a5d8c2 netfilter: nft_reject: introduce icmp code abstraction for inet and bridge ...

This patch introduces the NFT_REJECT_ICMPX_UNREACH type which provides
an abstraction to the ICMP and ICMPv6 codes that you can use from the
inet and bridge tables, they are:

* NFT_REJECT_ICMPX_NO_ROUTE: no route to host - network unreachable
* NFT_REJECT_ICMPX_PORT_UNREACH: port unreachable
* NFT_REJECT_ICMPX_HOST_UNREACH: host unreachable
* NFT_REJECT_ICMPX_ADMIN_PROHIBITED: administratevely prohibited

You can still use the specific codes when restricting the rule to match
the corresponding layer 3 protocol.

I decided to not overload the existing NFT_REJECT_ICMP_UNREACH to have
different semantics depending on the table family and to allow the user
to specify ICMP family specific codes if they restrict it to the
corresponding family.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2014-10-02 18:29:57 +02:00

..

arp_tables.c

netfilter: Can't fail and free after table replacement

2014-04-05 17:46:22 +02:00

arpt_mangle.c

…

arptable_filter.c

…

ip_tables.c

netfilter: Can't fail and free after table replacement

2014-04-05 17:46:22 +02:00

ipt_ah.c

…

ipt_CLUSTERIP.c

net: use reciprocal_scale() helper

2014-08-23 12:21:21 -07:00

ipt_ECN.c

…

ipt_MASQUERADE.c

netfilter: nf_nat: generalize IPv4 masquerading support for nf_tables

2014-09-09 16:31:29 +02:00

ipt_REJECT.c

…

ipt_rpfilter.c

ipv4, fib: pass LOOPBACK_IFINDEX instead of 0 to flowi4_iif

2014-04-16 15:05:11 -04:00

ipt_SYNPROXY.c

…

iptable_filter.c

…

iptable_mangle.c

…

iptable_nat.c

netfilter: nat: move specific NAT IPv4 to core

2014-09-02 17:14:10 +02:00

iptable_raw.c

…

iptable_security.c

…

Kconfig

netfilter: masquerading needs to be independent of x_tables in Kconfig

2014-09-12 09:40:18 +02:00

Makefile

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

2014-09-10 12:46:32 -07:00

nf_conntrack_l3proto_ipv4_compat.c

…

nf_conntrack_l3proto_ipv4.c

netfilter: nf_conntrack: remove exceptional & on function name

2014-07-25 14:50:58 +02:00

nf_conntrack_proto_icmp.c

netfilter: use IS_ENABLED() macro

2014-06-30 11:38:03 +02:00

nf_defrag_ipv4.c

netfilter: use IS_ENABLED() macro

2014-06-30 11:38:03 +02:00

nf_log_arp.c

netfilter: add generic ARP packet logger

2014-06-27 13:20:38 +02:00

nf_log_ipv4.c

netfilter: log: nf_log_packet() as real unified interface

2014-06-27 13:20:13 +02:00

nf_nat_h323.c

…

nf_nat_l3proto_ipv4.c

netfilter: nat: move specific NAT IPv4 to core

2014-09-02 17:14:10 +02:00

nf_nat_masquerade_ipv4.c

netfilter: nf_nat: generalize IPv4 masquerading support for nf_tables

2014-09-09 16:31:29 +02:00

nf_nat_pptp.c

…

nf_nat_proto_gre.c

netfilter: use IS_ENABLED() macro

2014-06-30 11:38:03 +02:00

nf_nat_proto_icmp.c

netfilter: use IS_ENABLED() macro

2014-06-30 11:38:03 +02:00

nf_nat_snmp_basic.c

netfilter: nf_nat_snmp_basic: fix duplicates in if/else branches

2014-02-14 11:37:36 +01:00

nf_tables_arp.c

…

nf_tables_ipv4.c

…

nft_chain_nat_ipv4.c

netfilter: nft_chain_nat_ipv4: use generic IPv4 NAT code from core

2014-09-02 17:14:11 +02:00

nft_chain_route_ipv4.c

…

nft_masq_ipv4.c

netfilter: nf_tables: add new nft_masq expression

2014-09-09 16:31:30 +02:00

nft_reject_ipv4.c

netfilter: nft_reject: introduce icmp code abstraction for inet and bridge

2014-10-02 18:29:57 +02:00