Rules can only accept or drop a packet, but sometimes we would like to drop the packet and notify the sender (TCP RST, ICMP host unreachable, ...). This is the purpose of iptables's REJECT verdict.
bpfilter should support a similar verdict to notify the sender and block the traffic. A packet would have to be crafted and returned (maybe through an elfstub?). The initial implementation could be limited to ICMP's host unreachable.
Rules can only accept or drop a packet, but sometimes we would like to drop the packet and notify the sender (TCP RST, ICMP host unreachable, ...). This is the purpose of iptables's
REJECTverdict.bpfilter should support a similar verdict to notify the sender and block the traffic. A packet would have to be crafted and returned (maybe through an elfstub?). The initial implementation could be limited to ICMP's host unreachable.