summaryrefslogtreecommitdiffstats
path: root/src/evaluate.c
diff options
context:
space:
mode:
authorAlvaro Neira <alvaroneay@gmail.com>2014-10-22 15:25:52 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2014-10-24 12:00:06 +0200
commit9554dd397309be84a96424d8087a5980638d7380 (patch)
tree459dcc688a8458215bdc8a4d33a7ffa568566eb5 /src/evaluate.c
parent9c449cd67d37dc07b6d50613c2ed00081bc9c3f8 (diff)
evaluate: reject: accept a reject reason with incorrect network context
nft add rule bridge test-bridge input ether type ip \ reject with icmpv6 type no-route This rule pass the evaluation step but the network context is incompatible with the reject reason. In that cases, we have to throw an error like "conflicting protocols specified: ip vs ip6" Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/evaluate.c')
-rw-r--r--src/evaluate.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/src/evaluate.c b/src/evaluate.c
index ff46fda3..977f6b49 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1237,6 +1237,8 @@ static int stmt_evaluate_reject_family(struct eval_ctx *ctx, struct stmt *stmt,
case __constant_htons(ETH_P_IP):
if (NFPROTO_IPV4 == stmt->reject.family)
break;
+ return stmt_error(ctx, stmt,
+ "conflicting protocols specified: ip vs ip6");
case __constant_htons(ETH_P_IPV6):
if (NFPROTO_IPV6 == stmt->reject.family)
break;