netfilter: nft_reject_inet: allow to use reject from inet ingress

Browse source

Enhance validation to support for reject from inet ingress chains.

Note that, reject from inet ingress and netdev ingress differ.

Reject packets from inet ingress are sent through ip_local_out() since
inet reject emulates the IP layer receive path. So the reject packet
follows to classic IP output and postrouting paths.

The reject action from netdev ingress assumes the packet not yet entered
the IP layer, so the reject packet is sent through dev_queue_xmit().
Therefore, reject packets from netdev ingress do not follow the classic
IP output and postrouting paths.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Pablo Neira Ayuso 2020-10-31 11:24:08 +01:00

parent 35b7ee34ab

commit 117ca1f892

3 changed files with 20 additions and 5 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

net/ipv4/netfilter/nf_reject_ipv4.c

View file

5

net/ipv6/netfilter/nf_reject_ipv6.c

View file

14

net/netfilter/nft_reject_inet.c

View file