netfilter: reject: don't send icmp error if csum is invalid

[deliverable/linux.git] / net / netfilter / nft_reject_inet.c

diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c
index 7b5f9d58680ad0ebca03c13e4a6f43037283bdc1..92877114aff4634b99c0c14d74d7043487bf31cc 100644 (file)
--- a/net/netfilter/nft_reject_inet.c
+++ b/net/netfilter/nft_reject_inet.c
@@ -28,14 +28,16 @@ static void nft_reject_inet_eval(const struct nft_expr *expr,
        case NFPROTO_IPV4:
                switch (priv->type) {
                case NFT_REJECT_ICMP_UNREACH:
-                       nf_send_unreach(pkt->skb, priv->icmp_code);
+                       nf_send_unreach(pkt->skb, priv->icmp_code,
+                                       pkt->ops->hooknum);
                        break;
                case NFT_REJECT_TCP_RST:
                        nf_send_reset(pkt->skb, pkt->ops->hooknum);
                        break;
                case NFT_REJECT_ICMPX_UNREACH:
                        nf_send_unreach(pkt->skb,
-                                       nft_reject_icmp_code(priv->icmp_code));
+                                       nft_reject_icmp_code(priv->icmp_code),
+                                       pkt->ops->hooknum);
                        break;
                }
                break;