From 3b5b389ae7cf34ff5b94ca3b7c96953715e56ba6 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 10 Aug 2017 19:29:17 +0200 Subject: nft.8: Review reject statement description - Describe 'type' argument datatypes in DATA TYPES section, then remove value list from reject statement description and refer to that section instead. - Fix synopsis: 'with ...' is optional. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- doc/nft.xml | 317 ++++++++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 256 insertions(+), 61 deletions(-) diff --git a/doc/nft.xml b/doc/nft.xml index 05790ba6..b1ca356e 100644 --- a/doc/nft.xml +++ b/doc/nft.xml @@ -1799,6 +1799,83 @@ filter output icmp type { echo-request, echo-reply } + + ICMP Code type + + + + + + + + + + Name + Keyword + Size + Base type + + + + + ICMP Code + icmp_code + 8 bit + integer + + + +
+ + + The ICMP Code type is used to conveniently specify the ICMP header's code field. + + + The following keywords may be used when specifying the ICMP code: + + + + + + + Keyword + Value + + + + + net-unreachable + 0 + + + host-unreachable + 1 + + + prot-unreachable + 2 + + + port-unreachable + 3 + + + net-prohibited + 9 + + + host-prohibited + 10 + + + admin-prohibited + 13 + + + +
+ + ICMPv6 Type type @@ -1931,6 +2008,146 @@ filter output icmpv6 type { echo-request, echo-reply } + + ICMPv6 Code type + + + + + + + + + + Name + Keyword + Size + Base type + + + + + ICMPv6 Code + icmpv6_code + 8 bit + integer + + + +
+ + + The ICMPv6 Code type is used to conveniently specify the ICMPv6 header's code field. + + + The following keywords may be used when specifying the ICMPv6 code: + + + + + + + Keyword + Value + + + + + no-route + 0 + + + admin-prohibited + 1 + + + addr-unreachable + 3 + + + port-unreachable + 4 + + + policy-fail + 5 + + + reject-route + 6 + + + +
+ + + + ICMPvX Code type + + + + + + + + + + Name + Keyword + Size + Base type + + + + + ICMPvX Code + icmpx_code + 8 bit + integer + + + +
+ + + The ICMPvX Code type abstraction is a set of values which + overlap between ICMP and ICMPv6 Code types to be used from the + inet family. + + + The following keywords may be used when specifying the ICMPvX code: + + + + + + + Keyword + Value + + + + + no-route + 0 + + + port-unreachable + 1 + + + host-unreachable + 2 + + + admin-prohibited + 3 + + + +
+ + Conntrack types @@ -4093,95 +4310,73 @@ ip6 filter output log flags all reject - with - - icmp - icmp6 - icmpx - - type - - icmp_type - icmp6_type - icmpx_type - + + with + + icmp + icmp6 + icmpx + + type + + icmp_type + icmp6_type + icmpx_type + + reject - with - tcp - reset + + with + tcp + reset + A reject statement is used to send back an error packet in response to the matched packet otherwise it is equivalent to drop so it is a terminating statement, ending rule traversal. This statement is only valid in the input, forward and output chains, and user-defined chains which are only called from those chains. + + + The different ICMP reject variants are meant for use in different table families: - reject statement type (ip) - - - - - - - Value - Description - Type - - - - - icmp_type - ICMP type response to be sent to the host - net-unreachable, host-unreachable, prot-unreachable, port-unreachable [default], net-prohibited, host-prohibited, admin-prohibited - - - -
- - reject statement type (ip6) - Value - Description + Variant + Family Type - icmp6_type - ICMPv6 type response to be sent to the host - no-route, admin-prohibited, addr-unreachable, port-unreachable [default], policy-fail, reject-route + icmp + ip + icmp_code - - -
- - reject statement type (inet) - - - - - - Value - Description - Type + icmp6 + ip6 + icmpv6_code - - - icmpx_type - ICMPvXtype abstraction response to be sent to the host, this is a set of types that overlap in IPv4 and IPv6 to be used from the inet family. - port-unreachable [default], admin-prohibited, no-route, host-unreachable + icmpx + inet + icmpx_code
+ + For a description of the different types and a list of supported + keywords refer to DATA TYPES section above. + The common default reject value is + port-unreachable. + Counter statement -- cgit v1.2.3