diff options
| -rw-r--r-- | src/evaluate.c | 12 | ||||
| -rw-r--r-- | src/netlink_delinearize.c | 1 |
2 files changed, 13 insertions, 0 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 2330bbb2..c15cd55f 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1132,6 +1132,18 @@ static int stmt_evaluate_meta(struct eval_ctx *ctx, struct stmt *stmt) static int stmt_evaluate_reject(struct eval_ctx *ctx, struct stmt *stmt) { + struct proto_ctx *pctx = &ctx->pctx; + const struct proto_desc *base; + + base = pctx->protocol[PROTO_BASE_TRANSPORT_HDR].desc; + if (base == NULL) + return -1; + + if (strcmp(base->name, "tcp") == 0) + stmt->reject.type = NFT_REJECT_TCP_RST; + else + stmt->reject.type = NFT_REJECT_ICMP_UNREACH; + stmt->flags |= STMT_F_TERMINAL; return 0; } diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index 5c6ca800..a98c68fc 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -456,6 +456,7 @@ static void netlink_parse_reject(struct netlink_parse_ctx *ctx, struct stmt *stmt; stmt = reject_stmt_alloc(loc); + stmt->reject.type = nft_rule_expr_get_u32(expr, NFT_EXPR_REJECT_TYPE); list_add_tail(&stmt->list, &ctx->rule->stmts); } |