On Mon, Jun 20, 2016 at 09:26:28PM +0800, Liping Zhang wrote: > From: Liping Zhang <liping.zhang@xxxxxxxxxxxxxx> > > In iptables, if the user add a rule to send tcp RST and specify the > non-TCP protocol, such as UDP, kernel will reject this request. But > in nftables, this validity check only occurs in nft tool, i.e. only > in userspace. > > This means that user can add such a rule like follows via nfnetlink: > "nft add rule filter forward ip protocol udp reject with tcp reset" > > This will generate some confusing tcp RST packets. So we should send > tcp RST only when it is TCP packet. Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
