* [nftables PATCH 1/2] reject: Check the protocol context for indicating the reject type
@ 2014-06-11 16:49 Alvaro Neira Ayuso
2014-06-16 10:00 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: Alvaro Neira Ayuso @ 2014-06-11 16:49 UTC (permalink / raw)
To: netfilter-devel; +Cc: kaber
This patch check the protocol context and initialize the reject type
considering if the transport protocol is tcp, udp, etc. Before, we
didn't initialize it
Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
---
src/evaluate.c | 12 ++++++++++++
src/netlink_delinearize.c | 1 +
2 files changed, 13 insertions(+)
diff --git a/src/evaluate.c b/src/evaluate.c
index 2330bbb..c15cd55 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1132,6 +1132,18 @@ static int stmt_evaluate_meta(struct eval_ctx *ctx, struct stmt *stmt)
static int stmt_evaluate_reject(struct eval_ctx *ctx, struct stmt *stmt)
{
+ struct proto_ctx *pctx = &ctx->pctx;
+ const struct proto_desc *base;
+
+ base = pctx->protocol[PROTO_BASE_TRANSPORT_HDR].desc;
+ if (base == NULL)
+ return -1;
+
+ if (strcmp(base->name, "tcp") == 0)
+ stmt->reject.type = NFT_REJECT_TCP_RST;
+ else
+ stmt->reject.type = NFT_REJECT_ICMP_UNREACH;
+
stmt->flags |= STMT_F_TERMINAL;
return 0;
}
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 5c6ca80..a98c68f 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -456,6 +456,7 @@ static void netlink_parse_reject(struct netlink_parse_ctx *ctx,
struct stmt *stmt;
stmt = reject_stmt_alloc(loc);
+ stmt->reject.type = nft_rule_expr_get_u32(expr, NFT_EXPR_REJECT_TYPE);
list_add_tail(&stmt->list, &ctx->rule->stmts);
}
--
1.7.10.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [nftables PATCH 1/2] reject: Check the protocol context for indicating the reject type
2014-06-11 16:49 [nftables PATCH 1/2] reject: Check the protocol context for indicating the reject type Alvaro Neira Ayuso
@ 2014-06-16 10:00 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2014-06-16 10:00 UTC (permalink / raw)
To: Alvaro Neira Ayuso; +Cc: netfilter-devel, kaber
On Wed, Jun 11, 2014 at 06:49:22PM +0200, Alvaro Neira Ayuso wrote:
> This patch check the protocol context and initialize the reject type
> considering if the transport protocol is tcp, udp, etc. Before, we
> didn't initialize it
Applied, thanks Alvaro.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-06-16 10:00 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-06-11 16:49 [nftables PATCH 1/2] reject: Check the protocol context for indicating the reject type Alvaro Neira Ayuso
2014-06-16 10:00 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).