| Message ID | 20160312172929.GA15987@sonyv |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
On Sat, Mar 12, 2016 at 06:29:32PM +0100, Laura Garcia Liebana wrote: > Avoid to print the reject with value in the translation when the value is the default. > > Before this patch: > > $ sudo iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT > nft add rule ip filter FORWARD tcp dport 22 counter reject with icmp type port-unreachable > > After this patch: > > $ sudo iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT > nft add rule ip filter FORWARD tcp dport 22 counter reject > > Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> > --- > extensions/libipt_REJECT.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/extensions/libipt_REJECT.c b/extensions/libipt_REJECT.c > index 4148776..0e9b7d7 100644 > --- a/extensions/libipt_REJECT.c > +++ b/extensions/libipt_REJECT.c > @@ -17,6 +17,8 @@ > #define IPT_ICMP_ADMIN_PROHIBITED IPT_TCP_RESET + 1 > #endif > > +#define DEFAULT_REJECT_WITH IPT_ICMP_PORT_UNREACHABLE This code is rather easy to read so I'd suggest no need to add this new definition, instead use IPT_ICMP_PORT_UNREACHABLE. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/extensions/libipt_REJECT.c b/extensions/libipt_REJECT.c index 4148776..0e9b7d7 100644 --- a/extensions/libipt_REJECT.c +++ b/extensions/libipt_REJECT.c @@ -17,6 +17,8 @@ #define IPT_ICMP_ADMIN_PROHIBITED IPT_TCP_RESET + 1 #endif +#define DEFAULT_REJECT_WITH IPT_ICMP_PORT_UNREACHABLE + struct reject_names { const char *name; const char *alias; @@ -92,7 +94,7 @@ static void REJECT_init(struct xt_entry_target *t) struct ipt_reject_info *reject = (struct ipt_reject_info *)t->data; /* default */ - reject->with = IPT_ICMP_PORT_UNREACHABLE; + reject->with = DEFAULT_REJECT_WITH; } @@ -171,7 +173,9 @@ static int REJECT_xlate(const void *ip, const struct xt_entry_target *target, break; } - if (reject->with == IPT_TCP_RESET) + if (reject->with == DEFAULT_REJECT_WITH) + xt_xlate_add(xl, "reject"); + else if (reject->with == IPT_TCP_RESET) xt_xlate_add(xl, "reject with %s", reject_table_xlate[i].name); else
Avoid to print the reject with value in the translation when the value is the default. Before this patch: $ sudo iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT nft add rule ip filter FORWARD tcp dport 22 counter reject with icmp type port-unreachable After this patch: $ sudo iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT nft add rule ip filter FORWARD tcp dport 22 counter reject Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> --- extensions/libipt_REJECT.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)