add rule bridge test-bridge input reject with icmp type port-unreachable
... will be printed as 'reject', which is fine on ip family, but not on
bridge -- 'with icmp type' adds an ipv4 dependency, but simple reject
does not (it will use icmpx to also reject ipv6 packets with an icmpv6 error).
Add a toggle to supress short-hand versions in this case.
Signed-off-by: Florian Westphal <f...@strlen.de>
---
include/statement.h | 3 ++-
src/json.c | 6 ++++--
src/netlink_delinearize.c | 6 ++++++
src/statement.c | 6 ++++--
4 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/include/statement.h b/include/statement.h
index 91d6e0e2cb81..6fb5cf15f8bd 100644
--- a/include/statement.h
+++ b/include/statement.h
@@ -102,8 +102,9 @@ extern void __limit_stmt_print(const struct limit_stmt
*limit);
struct reject_stmt {
struct expr *expr;
- enum nft_reject_types type;
+ enum nft_reject_types type:8;
int8_t icmp_code;
+ uint8_t verbose_print:1;
unsigned int family;
};
diff --git a/src/json.c b/src/json.c
index a503a97500a9..e0127c5741a0 100644
--- a/src/json.c
+++ b/src/json.c
@@ -1311,13 +1311,15 @@ json_t *reject_stmt_json(const struct stmt *stmt,
struct output_ctx *octx)
case NFT_REJECT_ICMP_UNREACH:
switch (stmt->reject.family) {
case NFPROTO_IPV4:
- if (stmt->reject.icmp_code == ICMP_PORT_UNREACH)
+ if (!stmt->reject.verbose_print &&
+ stmt->reject.icmp_code == ICMP_PORT_UNREACH)
break;
type = "icmp";
jexpr = expr_print_json(stmt->reject.expr, octx);
break;
case NFPROTO_IPV6:
- if (stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT)
+ if (!stmt->reject.verbose_print &&
+ stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT)
break;
type = "icmpv6";
jexpr = expr_print_json(stmt->reject.expr, octx);
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 4d720d2938fc..a4044f0c7329 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -2202,6 +2202,12 @@ static void stmt_reject_postprocess(struct rule_pp_ctx
*rctx)
datatype_set(stmt->reject.expr, &icmpx_code_type);
break;
}
+
+ /* always print full icmp(6) name, simple 'reject' might be
ambiguious
+ * because ipv4 vs. ipv6 info might be lost
+ */
+ stmt->reject.verbose_print = 1;
+
base = rctx->pctx.protocol[PROTO_BASE_LL_HDR].desc;
desc = rctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc;
protocol = proto_find_num(base, desc);
diff --git a/src/statement.c b/src/statement.c
index a9e8b3ae0780..c5594233a45f 100644
--- a/src/statement.c
+++ b/src/statement.c
@@ -516,13 +516,15 @@ static void reject_stmt_print(const struct stmt *stmt,
struct output_ctx *octx)
case NFT_REJECT_ICMP_UNREACH:
switch (stmt->reject.family) {
case NFPROTO_IPV4:
- if (stmt->reject.icmp_code == ICMP_PORT_UNREACH)
+ if (!stmt->reject.verbose_print &&
+ stmt->reject.icmp_code == ICMP_PORT_UNREACH)
break;
nft_print(octx, " with icmp type ");
expr_print(stmt->reject.expr, octx);
break;
case NFPROTO_IPV6:
- if (stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT)
+ if (!stmt->reject.verbose_print &&
+ stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT)
break;
nft_print(octx, " with icmpv6 type ");
expr_print(stmt->reject.expr, octx);
--
2.21.0
