evaluate: reject: accept a reject reason with incorrect network context

nft add rule bridge test-bridge input ether type ip \
				reject with icmpv6 type no-route

This rule pass the evaluation step but the network context is incompatible with
the reject reason. In that cases, we have to throw an error like "conflicting
protocols specified: ip vs ip6"

Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index ff46fda3f24d69ddb7ac4951b25eba72ed350260..977f6b494672d9fa35d1481869f77e6e8bedbc7a 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1237,6 +1237,8 @@ static int stmt_evaluate_reject_family(struct eval_ctx *ctx, struct stmt *stmt,
                        case __constant_htons(ETH_P_IP):
                                if (NFPROTO_IPV4 == stmt->reject.family)
                                        break;
+                               return stmt_error(ctx, stmt,
+                                 "conflicting protocols specified: ip vs ip6");
                        case __constant_htons(ETH_P_IPV6):
                                if (NFPROTO_IPV6 == stmt->reject.family)
                                        break;