This patch check the protocol context and initialize the reject type
considering if the transport protocol is tcp, udp, etc. Before, we
didn't initialize it
Signed-off-by: Alvaro Neira Ayuso <alvaroneay@xxxxxxxxx>
---
src/evaluate.c | 12 ++++++++++++
src/netlink_delinearize.c | 1 +
2 files changed, 13 insertions(+)
diff --git a/src/evaluate.c b/src/evaluate.c
index 2330bbb..c15cd55 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1132,6 +1132,18 @@ static int stmt_evaluate_meta(struct eval_ctx *ctx, struct stmt *stmt)
static int stmt_evaluate_reject(struct eval_ctx *ctx, struct stmt *stmt)
{
+ struct proto_ctx *pctx = &ctx->pctx;
+ const struct proto_desc *base;
+
+ base = pctx->protocol[PROTO_BASE_TRANSPORT_HDR].desc;
+ if (base == NULL)
+ return -1;
+
+ if (strcmp(base->name, "tcp") == 0)
+ stmt->reject.type = NFT_REJECT_TCP_RST;
+ else
+ stmt->reject.type = NFT_REJECT_ICMP_UNREACH;
+
stmt->flags |= STMT_F_TERMINAL;
return 0;
}
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 5c6ca80..a98c68f 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -456,6 +456,7 @@ static void netlink_parse_reject(struct netlink_parse_ctx *ctx,
struct stmt *stmt;
stmt = reject_stmt_alloc(loc);
+ stmt->reject.type = nft_rule_expr_get_u32(expr, NFT_EXPR_REJECT_TYPE);
list_add_tail(&stmt->list, &ctx->rule->stmts);
}
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
