On Sat, Mar 12, 2016 at 06:29:32PM +0100, Laura Garcia Liebana wrote: > Avoid to print the reject with value in the translation when the value is the default. > > Before this patch: > > $ sudo iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT > nft add rule ip filter FORWARD tcp dport 22 counter reject with icmp type port-unreachable > > After this patch: > > $ sudo iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT > nft add rule ip filter FORWARD tcp dport 22 counter reject > > Signed-off-by: Laura Garcia Liebana <nevola@xxxxxxxxx> > --- > extensions/libipt_REJECT.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/extensions/libipt_REJECT.c b/extensions/libipt_REJECT.c > index 4148776..0e9b7d7 100644 > --- a/extensions/libipt_REJECT.c > +++ b/extensions/libipt_REJECT.c > @@ -17,6 +17,8 @@ > #define IPT_ICMP_ADMIN_PROHIBITED IPT_TCP_RESET + 1 > #endif > > +#define DEFAULT_REJECT_WITH IPT_ICMP_PORT_UNREACHABLE This code is rather easy to read so I'd suggest no need to add this new definition, instead use IPT_ICMP_PORT_UNREACHABLE. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
