summaryrefslogtreecommitdiffstats
path: root/src/netlink_delinearize.c
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2014-06-20 14:58:54 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2014-06-20 15:00:02 +0200
commit6b39cecf634ade76ae6b19c632ef5890639481cb (patch)
treed0341b9d56091aa541b6d0240bcf59283315af3c /src/netlink_delinearize.c
parent34040b1e345c8fa31b1c468713ff7c3815e4a8a1 (diff)
src: revert broken reject icmp code support
This patch reverts Alvaro's 34040b1 ("reject: add ICMP code parameter for indicating the type of error") and 11b2bb2 ("reject: Use protocol context for indicating the reject type"). These patches are flawed by two things: 1) IPv6 support is broken, only ICMP codes are considered. 2) If you don't specify any transport context, the utility exits without adding the rule, eg. nft add rule ip filter input reject. The kernel is also flawed when it comes to the inet table. Let's revert this until we can provide decent reject reason support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/netlink_delinearize.c')
-rw-r--r--src/netlink_delinearize.c3
1 files changed, 0 insertions, 3 deletions
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 8d30b2d2..5c6ca800 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -456,9 +456,6 @@ static void netlink_parse_reject(struct netlink_parse_ctx *ctx,
struct stmt *stmt;
stmt = reject_stmt_alloc(loc);
- stmt->reject.type = nft_rule_expr_get_u32(expr, NFT_EXPR_REJECT_TYPE);
- stmt->reject.icmp_code =
- nft_rule_expr_get_u8(expr, NFT_EXPR_REJECT_CODE);
list_add_tail(&stmt->list, &ctx->rule->stmts);
}