diff mbox

[nft,08/10] src: add a comment wrt. reject dependency insertion

Message ID 20170509155122.26356-9-fw@strlen.de
State Changes Requested
Delegated to: Pablo Neira
Headers show

Commit Message

Florian Westphal May 9, 2017, 3:51 p.m. UTC 
at first I thought this was a bug but this in fact seems the right
thing, add a comment/example why adding dependency as first statement makes
sense.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 src/evaluate.c | 8 ++++++++
 1 file changed, 8 insertions(+)
diff mbox

Patch

diff --git a/src/evaluate.c b/src/evaluate.c
index 1cfe7675162e..27cee98916db 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2015,6 +2015,14 @@  static int stmt_reject_gen_dependency(struct eval_ctx *ctx, struct stmt *stmt,
 	if (payload_gen_dependency(ctx, payload, &nstmt) < 0)
 		return -1;
 
+	/*
+	 * Unlike payload deps this adds the dependency at the beginning, i.e.
+	 * log ... reject with tcp-reset
+	 * turns into
+	 * meta l4proto tcp log ... reject with tcp-reset
+	 *
+	 * Otherwise we'd log things that won't be rejected.
+	 */
 	list_add(&nstmt->list, &ctx->rule->stmts);
 	return 0;
 }