Re: nftables: How to match ICMPv6 subtype in a rule?

["William N." <netfilter@riseup.net>]

Thanks for clarifying.

I actually found the magic word "code" after posting here but I still
wanted to wait for a reply. Yours explained it perfectly. I suppose I
have been confused by reading too much from different sources :)

On Sun, 31 Mar 2024 07:33:42 +0100 Kerin Millar wrote:

> However, there are some errors in the manual. [...]

Have those been reported anywhere?

> icmpv6 code <icmpv6_code> # where <icmpv6_code> is any valid ICMPV6
> CODE value

Having such possibility is interesting, as the integer code has
different meaning depending on the type, i.e. it has no meaning per se
and it looks strange to filter based on it only. I thought they must go
"hand in hand" but obviously not. I wonder what purpose such filtering
may serve.

In that sense, the output of:

> # nft describe icmpv6_code

is somewhat confusing (e.g. compare type 1 and type 3 or 4 in RFC 4443).