From a8347553432c1852925ec51cc66b6676b81fbfec Mon Sep 17 00:00:00 2001 From: Duncan Roe Date: Fri, 6 Dec 2019 13:37:12 +1100 Subject: doc: Clarify conditions under which a reject verdict is permissible A phrase like "input chain" is a throwback to xtables documentation. In nft, chains are containers for rules. They do have a type, but what's important here is which hook each uses. Signed-off-by: Duncan Roe Signed-off-by: Florian Westphal --- doc/statements.txt | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/doc/statements.txt b/doc/statements.txt index 3b824367..ced311cb 100644 --- a/doc/statements.txt +++ b/doc/statements.txt @@ -171,8 +171,9 @@ ____ A reject statement is used to send back an error packet in response to the matched packet otherwise it is equivalent to drop so it is a terminating -statement, ending rule traversal. This statement is only valid in the input, -forward and output chains, and user-defined chains which are only called from +statement, ending rule traversal. This statement is only valid in base chains +using the *input*, +*forward* or *output* hooks, and user-defined chains which are only called from those chains. .different ICMP reject variants are meant for use in different table families -- cgit v1.2.3