extensions: libip6t_REJECT: Avoid to print the default reject with value in the translation
PATCH 1/1 extensions: libip6t_REJECT: Avoid to print the default reject with value in the translation
Avoid to print the reject with value in the translation when the value is the default.
Before this patch:
$ sudo ip6tables-translate -A FORWARD -p TCP --dport 22 -j REJECT nft add rule ip6 filter FORWARD tcp dport 22 counter reject with icmpv6 type port-unreachable
After this patch:
$ sudo ip6tables-translate -A FORWARD -p TCP --dport 22 -j REJECT nft add rule ip6 filter FORWARD tcp dport 22 counter reject
Signed-off-by Laura Garcia Liebana <[email protected]>
--- extensions/libip6t_REJECT.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
extensions/libip6t_REJECT.c +7 -2
@@ -10,6 +10,8 @@#include <xtables.h> #include <linux/netfilter_ipv6/ip6t_REJECT.h> +#define DEFAULT_REJECT_WITH IP6T_ICMP6_PORT_UNREACH +struct reject_names {const char *name;const char *alias;
@@ -81,7 +83,7 @@ static void REJECT_init(struct xt_entry_target *t)struct ip6t_reject_info *reject = (struct ip6t_reject_info *)t->data;/* default */ - reject->with =IP6T_ICMP6_PORT_UNREACH ; + reject->with =DEFAULT_REJECT_WITH ; }
@@ -149,7 +151,10 @@ static int REJECT_xlate(const void *ip, const struct xt_entry_target *target,for (i =0 ; i <ARRAY_SIZE (reject_table_xlate); ++i)if (reject_table_xlate[i].with == reject->with)break ; -if (reject->with ==IP6T_TCP_RESET ) + +if (reject->with ==DEFAULT_REJECT_WITH ) +xt_xlate_add (xl,"reject" ); +else if (reject->with ==IP6T_TCP_RESET )xt_xlate_add (xl,"reject with %s" , reject_table_xlate[i].name);else xt_xlate_add(xl, "reject with icmpv6 type %s",
Signature · 1 line
2.7.0