| Message ID | 1413984353-16029-1-git-send-email-alvaroneay@gmail.com |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
On Wed, Oct 22, 2014 at 03:25:52PM +0200, Alvaro Neira Ayuso wrote: > nft add rule bridge test-bridge input ether type ip \ > reject with icmpv6 type no-route > > This rule pass the evaluation step but the network context is incompatible with > the reject reason. In that cases, we have to throw an error like "conflicting > protocols specified: ip vs ip6" Applied, thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/src/evaluate.c b/src/evaluate.c index ff46fda..977f6b4 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1237,6 +1237,8 @@ static int stmt_evaluate_reject_family(struct eval_ctx *ctx, struct stmt *stmt, case __constant_htons(ETH_P_IP): if (NFPROTO_IPV4 == stmt->reject.family) break; + return stmt_error(ctx, stmt, + "conflicting protocols specified: ip vs ip6"); case __constant_htons(ETH_P_IPV6): if (NFPROTO_IPV6 == stmt->reject.family) break;
nft add rule bridge test-bridge input ether type ip \ reject with icmpv6 type no-route This rule pass the evaluation step but the network context is incompatible with the reject reason. In that cases, we have to throw an error like "conflicting protocols specified: ip vs ip6" Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> --- [no changes in v3] src/evaluate.c | 2 ++ 1 file changed, 2 insertions(+)