src: statement: disable reject statement type omission for bridge

add rule bridge test-bridge input reject with icmp type port-unreachable

... will be printed as 'reject', which is fine on ip family, but not on
bridge -- 'with icmp type' adds an ipv4 dependency, but simple reject
does not (it will use icmpx to also reject ipv6 packets with an icmpv6 error).

Add a toggle to supress short-hand versions in this case.

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/statement.h b/include/statement.h
index 91d6e0e2cb8194ccf3d3593617363cfcc54d8319..6fb5cf15f8bdd8b625ca685f34af9160038f023f 100644 (file)
--- a/include/statement.h
+++ b/include/statement.h
@@ -102,8 +102,9 @@ extern void __limit_stmt_print(const struct limit_stmt *limit);
 
 struct reject_stmt {
        struct expr             *expr;
-       enum nft_reject_types   type;
+       enum nft_reject_types   type:8;
        int8_t                  icmp_code;
+       uint8_t                 verbose_print:1;
        unsigned int            family;
 };
 

diff --git a/src/json.c b/src/json.c
index a503a97500a97d708319b51ef4c44ffae2fe2254..e0127c5741a0627b12cf2d906232ea2d60db99e4 100644 (file)
--- a/src/json.c
+++ b/src/json.c
@@ -1311,13 +1311,15 @@ json_t *reject_stmt_json(const struct stmt *stmt, struct output_ctx *octx)
        case NFT_REJECT_ICMP_UNREACH:
                switch (stmt->reject.family) {
                case NFPROTO_IPV4:
-                       if (stmt->reject.icmp_code == ICMP_PORT_UNREACH)
+                       if (!stmt->reject.verbose_print &&
+                           stmt->reject.icmp_code == ICMP_PORT_UNREACH)
                                break;
                        type = "icmp";
                        jexpr = expr_print_json(stmt->reject.expr, octx);
                        break;
                case NFPROTO_IPV6:
-                       if (stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT)
+                       if (!stmt->reject.verbose_print &&
+                           stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT)
                                break;
                        type = "icmpv6";
                        jexpr = expr_print_json(stmt->reject.expr, octx);

diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 4d720d2938fc0b834400da10eb3de866a88cbd28..a4044f0c7329dd2b10f4372a04d9ac46148fc47c 100644 (file)
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -2202,6 +2202,12 @@ static void stmt_reject_postprocess(struct rule_pp_ctx *rctx)
                        datatype_set(stmt->reject.expr, &icmpx_code_type);
                        break;
                }
+
+               /* always print full icmp(6) name, simple 'reject' might be ambiguious
+                * because ipv4 vs. ipv6 info might be lost
+                */
+               stmt->reject.verbose_print = 1;
+
                base = rctx->pctx.protocol[PROTO_BASE_LL_HDR].desc;
                desc = rctx->pctx.protocol[PROTO_BASE_NETWORK_HDR].desc;
                protocol = proto_find_num(base, desc);

diff --git a/src/statement.c b/src/statement.c
index a9e8b3ae07807fac84adf93f9489033434104223..c5594233a45f33cbf9d753e48b165733981d629f 100644 (file)
--- a/src/statement.c
+++ b/src/statement.c
@@ -516,13 +516,15 @@ static void reject_stmt_print(const struct stmt *stmt, struct output_ctx *octx)
        case NFT_REJECT_ICMP_UNREACH:
                switch (stmt->reject.family) {
                case NFPROTO_IPV4:
-                       if (stmt->reject.icmp_code == ICMP_PORT_UNREACH)
+                       if (!stmt->reject.verbose_print &&
+                            stmt->reject.icmp_code == ICMP_PORT_UNREACH)
                                break;
                        nft_print(octx, " with icmp type ");
                        expr_print(stmt->reject.expr, octx);
                        break;
                case NFPROTO_IPV6:
-                       if (stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT)
+                       if (!stmt->reject.verbose_print &&
+                           stmt->reject.icmp_code == ICMP6_DST_UNREACH_NOPORT)
                                break;
                        nft_print(octx, " with icmpv6 type ");
                        expr_print(stmt->reject.expr, octx);