Laura Garcia Liebana f53b9b0bdc netfilter: introduce support for reject at prerouting stage ...

REJECT statement can be only used in INPUT, FORWARD and OUTPUT
chains. This patch adds support of REJECT, both icmp and tcp
reset, at PREROUTING stage.

The need for this patch comes from the requirement of some
forwarding devices to reject traffic before the natting and
routing decisions.

The main use case is to be able to send a graceful termination
to legitimate clients that, under any circumstances, the NATed
endpoints are not available. This option allows clients to
decide either to perform a reconnection or manage the error in
their side, instead of just dropping the connection and let
them die due to timeout.

It is supported ipv4, ipv6 and inet families for nft
infrastructure.

Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2020-06-30 18:21:02 +02:00

..

ip6_tables.c

netfilter: ip6tables: Split ip6t_unregister_table() into pre_exit and exit helpers.

2020-06-25 00:50:31 +02:00

ip6t_ah.c

ipv6: Use ipv6_authlen for len

2019-07-11 14:43:25 -07:00

ip6t_eui64.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

ip6t_frag.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

ip6t_hbh.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

ip6t_ipv6header.c

netfilter: move inline nf_ip6_ext_hdr() function to a more appropriate header.

2019-09-13 12:34:09 +02:00

ip6t_mh.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

ip6t_NPT.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

ip6t_REJECT.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

ip6t_rpfilter.c

netfilter: Fix rpfilter dropping vrf packets by mistake

2019-07-16 13:16:47 +02:00

ip6t_rt.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

ip6t_srh.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

ip6t_SYNPROXY.c

netfilter: Add MODULE_DESCRIPTION entries to kernel modules

2020-06-25 00:50:31 +02:00

ip6table_filter.c

netfilter: ip6tables: Add a .pre_exit hook in all ip6table_foo.c.

2020-06-25 00:50:31 +02:00

ip6table_mangle.c

netfilter: ip6tables: Add a .pre_exit hook in all ip6table_foo.c.

2020-06-25 00:50:31 +02:00

ip6table_nat.c

netfilter: ip6tables: Add a .pre_exit hook in all ip6table_foo.c.

2020-06-25 00:50:31 +02:00

ip6table_raw.c

netfilter: ip6tables: Add a .pre_exit hook in all ip6table_foo.c.

2020-06-25 00:50:31 +02:00

ip6table_security.c

netfilter: ip6tables: Add a .pre_exit hook in all ip6table_foo.c.

2020-06-25 00:50:31 +02:00

Kconfig

treewide: replace '---help---' in Kconfig files with 'help'

2020-06-14 01:57:21 +09:00

Makefile

netfilter: x_tables: merge ip and ipv6 masquerade modules

2019-04-11 20:59:29 +02:00

nf_conntrack_reasm.c

inet: frags: re-introduce skb coalescing for local delivery

2019-08-08 15:55:10 -07:00

nf_defrag_ipv6_hooks.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

nf_dup_ipv6.c

netfilter: drop bridge nf reset from nf_reset

2019-10-01 18:42:15 +02:00

nf_flow_table_ipv6.c

netfilter: Add MODULE_DESCRIPTION entries to kernel modules

2020-06-25 00:50:31 +02:00

nf_log_ipv6.c

inet: Use fallthrough;

2020-03-12 15:55:00 -07:00

nf_reject_ipv6.c

netfilter: introduce support for reject at prerouting stage

2020-06-30 18:21:02 +02:00

nf_socket_ipv6.c

netfilter: update include directives.

2019-09-13 12:33:06 +02:00

nf_tproxy_ipv6.c

netfilter: nft_tproxy: Fix typo in IPv6 module description.

2019-10-17 12:21:11 +02:00

nft_dup_ipv6.c

netfilter: Add MODULE_DESCRIPTION entries to kernel modules

2020-06-25 00:50:31 +02:00

nft_fib_ipv6.c

netfilter: Add MODULE_DESCRIPTION entries to kernel modules

2020-06-25 00:50:31 +02:00

nft_reject_ipv6.c

netfilter: Add MODULE_DESCRIPTION entries to kernel modules

2020-06-25 00:50:31 +02:00