[nftables PATCH 1/2] reject: Check the protocol context for indicating the reject type

[Alvaro Neira Ayuso <alvaroneay@gmail.com>]

This patch check the protocol context and initialize the reject type
considering if the transport protocol is tcp, udp, etc. Before, we
didn't initialize it

Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
---
 src/evaluate.c            |   12 ++++++++++++
 src/netlink_delinearize.c |    1 +
 2 files changed, 13 insertions(+)

diff --git a/src/evaluate.c b/src/evaluate.c
index 2330bbb..c15cd55 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1132,6 +1132,18 @@ static int stmt_evaluate_meta(struct eval_ctx *ctx, struct stmt *stmt)
 
 static int stmt_evaluate_reject(struct eval_ctx *ctx, struct stmt *stmt)
 {
+	struct proto_ctx *pctx = &ctx->pctx;
+	const struct proto_desc *base;
+
+	base = pctx->protocol[PROTO_BASE_TRANSPORT_HDR].desc;
+	if (base == NULL)
+		return -1;
+
+	if (strcmp(base->name, "tcp") == 0)
+		stmt->reject.type = NFT_REJECT_TCP_RST;
+	else
+		stmt->reject.type = NFT_REJECT_ICMP_UNREACH;
+
 	stmt->flags |= STMT_F_TERMINAL;
 	return 0;
 }
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 5c6ca80..a98c68f 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -456,6 +456,7 @@ static void netlink_parse_reject(struct netlink_parse_ctx *ctx,
 	struct stmt *stmt;
 
 	stmt = reject_stmt_alloc(loc);
+	stmt->reject.type = nft_rule_expr_get_u32(expr, NFT_EXPR_REJECT_TYPE);
 	list_add_tail(&stmt->list, &ctx->rule->stmts);
 }
 
-- 
1.7.10.4