diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/json.c | 6 | ||||
| -rw-r--r-- | src/netlink_delinearize.c | 6 | ||||
| -rw-r--r-- | src/statement.c | 6 |
3 files changed, 14 insertions, 4 deletions
@@ -1311,13 +1311,15 @@ json_t *reject_stmt_json(const struct stmt *stmt, struct output_ctx *octx) case NFT_REJECT_ICMP_UNREACH: switch (stmt->reject.family) { case NFPROTO_IPV4: - if (stmt->reject.icmp_code == ICMP_PORT_UNREACH) + if (!stmt->reject.verbose_print && + stmt->reject.icmp_code == ICMP_PORT_UNREACH) break; type = "icmp"; jexpr = expr_print_json(stmt->reject.expr, octx); break; case NFPROTO_IPV6: - if (stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT) + if (!stmt->reject.verbose_print && + stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT) break; type = "icmpv6"; jexpr = expr_print_json(stmt->reject.expr, octx); diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index 4d720d29..a4044f0c 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -2202,6 +2202,12 @@ static void stmt_reject_postprocess(struct rule_pp_ctx *rctx) datatype_set(stmt->reject.expr, &icmpx_code_type); break; } + + /* always print full icmp(6) name, simple 'reject' might be ambiguious + * because ipv4 vs. ipv6 info might be lost + */ + stmt->reject.verbose_print = 1; + base = rctx->pctx.protocol[PROTO_BASE_LL_HDR].desc; desc = rctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc; protocol = proto_find_num(base, desc); diff --git a/src/statement.c b/src/statement.c index a9e8b3ae..c5594233 100644 --- a/src/statement.c +++ b/src/statement.c @@ -516,13 +516,15 @@ static void reject_stmt_print(const struct stmt *stmt, struct output_ctx *octx) case NFT_REJECT_ICMP_UNREACH: switch (stmt->reject.family) { case NFPROTO_IPV4: - if (stmt->reject.icmp_code == ICMP_PORT_UNREACH) + if (!stmt->reject.verbose_print && + stmt->reject.icmp_code == ICMP_PORT_UNREACH) break; nft_print(octx, " with icmp type "); expr_print(stmt->reject.expr, octx); break; case NFPROTO_IPV6: - if (stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT) + if (!stmt->reject.verbose_print && + stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT) break; nft_print(octx, " with icmpv6 type "); expr_print(stmt->reject.expr, octx); |