From b65ea148d8f8edc4ef5774154b1aca25d884d500 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Tue, 18 Jun 2019 20:43:58 +0200 Subject: src: statement: disable reject statement type omission for bridge add rule bridge test-bridge input reject with icmp type port-unreachable ... will be printed as 'reject', which is fine on ip family, but not on bridge -- 'with icmp type' adds an ipv4 dependency, but simple reject does not (it will use icmpx to also reject ipv6 packets with an icmpv6 error). Add a toggle to supress short-hand versions in this case. Signed-off-by: Florian Westphal Acked-by: Pablo Neira Ayuso --- src/statement.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/statement.c') diff --git a/src/statement.c b/src/statement.c index a9e8b3ae..c5594233 100644 --- a/src/statement.c +++ b/src/statement.c @@ -516,13 +516,15 @@ static void reject_stmt_print(const struct stmt *stmt, struct output_ctx *octx) case NFT_REJECT_ICMP_UNREACH: switch (stmt->reject.family) { case NFPROTO_IPV4: - if (stmt->reject.icmp_code == ICMP_PORT_UNREACH) + if (!stmt->reject.verbose_print && + stmt->reject.icmp_code == ICMP_PORT_UNREACH) break; nft_print(octx, " with icmp type "); expr_print(stmt->reject.expr, octx); break; case NFPROTO_IPV6: - if (stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT) + if (!stmt->reject.verbose_print && + stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT) break; nft_print(octx, " with icmpv6 type "); expr_print(stmt->reject.expr, octx); -- cgit v1.2.3