diff options
| author | Florian Westphal <fw@strlen.de> | 2019-06-18 20:43:58 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2019-06-19 22:52:21 +0200 |
| commit | b65ea148d8f8edc4ef5774154b1aca25d884d500 (patch) | |
| tree | 35c10223e681ef2d77b43554dd07b965cb14a222 /src/netlink_delinearize.c | |
| parent | ea046380431f5cc623daf8c9d7b2c5438a90a84f (diff) | |
src: statement: disable reject statement type omission for bridge
add rule bridge test-bridge input reject with icmp type port-unreachable
... will be printed as 'reject', which is fine on ip family, but not on
bridge -- 'with icmp type' adds an ipv4 dependency, but simple reject
does not (it will use icmpx to also reject ipv6 packets with an icmpv6 error).
Add a toggle to supress short-hand versions in this case.
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/netlink_delinearize.c')
| -rw-r--r-- | src/netlink_delinearize.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index 4d720d29..a4044f0c 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -2202,6 +2202,12 @@ static void stmt_reject_postprocess(struct rule_pp_ctx *rctx) datatype_set(stmt->reject.expr, &icmpx_code_type); break; } + + /* always print full icmp(6) name, simple 'reject' might be ambiguious + * because ipv4 vs. ipv6 info might be lost + */ + stmt->reject.verbose_print = 1; + base = rctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; desc = rctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc; protocol = proto_find_num(base, desc); |