Re: [PATCH] extensions: libipt_REJECT: Avoid to print the default reject with value in the translation

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sat, Mar 12, 2016 at 06:29:32PM +0100, Laura Garcia Liebana wrote:
> Avoid to print the reject with value in the translation when the value is the default.
> 
> Before this patch:
> 
> $ sudo iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT
> nft add rule ip filter FORWARD tcp dport 22 counter reject with icmp type port-unreachable
> 
> After this patch:
> 
> $ sudo iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT
> nft add rule ip filter FORWARD tcp dport 22 counter reject
> 
> Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
> ---
>  extensions/libipt_REJECT.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/extensions/libipt_REJECT.c b/extensions/libipt_REJECT.c
> index 4148776..0e9b7d7 100644
> --- a/extensions/libipt_REJECT.c
> +++ b/extensions/libipt_REJECT.c
> @@ -17,6 +17,8 @@
>  #define IPT_ICMP_ADMIN_PROHIBITED	IPT_TCP_RESET + 1
>  #endif
>  
> +#define DEFAULT_REJECT_WITH	IPT_ICMP_PORT_UNREACHABLE

This code is rather easy to read so I'd suggest no need to add this
new definition, instead use IPT_ICMP_PORT_UNREACHABLE.

Thanks.