From 9554dd397309be84a96424d8087a5980638d7380 Mon Sep 17 00:00:00 2001 From: Alvaro Neira Date: Wed, 22 Oct 2014 15:25:52 +0200 Subject: evaluate: reject: accept a reject reason with incorrect network context nft add rule bridge test-bridge input ether type ip \ reject with icmpv6 type no-route This rule pass the evaluation step but the network context is incompatible with the reject reason. In that cases, we have to throw an error like "conflicting protocols specified: ip vs ip6" Signed-off-by: Alvaro Neira Ayuso Signed-off-by: Pablo Neira Ayuso --- src/evaluate.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/evaluate.c b/src/evaluate.c index ff46fda3..977f6b49 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1237,6 +1237,8 @@ static int stmt_evaluate_reject_family(struct eval_ctx *ctx, struct stmt *stmt, case __constant_htons(ETH_P_IP): if (NFPROTO_IPV4 == stmt->reject.family) break; + return stmt_error(ctx, stmt, + "conflicting protocols specified: ip vs ip6"); case __constant_htons(ETH_P_IPV6): if (NFPROTO_IPV6 == stmt->reject.family) break; -- cgit v1.2.3