From 3f0324f0a2a727fe4b86333306634a78593ccb80 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Sun, 7 May 2017 01:09:19 +0200 Subject: netlink_delinearize: reject: remove dependency for tcp-resets We can remove a l4 dependency in ip/ipv6 families. Signed-off-by: Florian Westphal --- src/netlink_delinearize.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'src') diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c index f0288cd4..49dc6a60 100644 --- a/src/netlink_delinearize.c +++ b/src/netlink_delinearize.c @@ -1856,10 +1856,16 @@ static void stmt_reject_postprocess(struct rule_pp_ctx *rctx) case NFPROTO_IPV4: stmt->reject.family = rctx->pctx.family; stmt->reject.expr->dtype = &icmp_code_type; + if (stmt->reject.type == NFT_REJECT_TCP_RST) + __payload_dependency_kill(&rctx->pdctx, + PROTO_BASE_TRANSPORT_HDR); break; case NFPROTO_IPV6: stmt->reject.family = rctx->pctx.family; stmt->reject.expr->dtype = &icmpv6_code_type; + if (stmt->reject.type == NFT_REJECT_TCP_RST) + __payload_dependency_kill(&rctx->pdctx, + PROTO_BASE_TRANSPORT_HDR); break; case NFPROTO_INET: if (stmt->reject.type == NFT_REJECT_ICMPX_UNREACH) { -- cgit v1.2.3