Commit da683650 authored by Eric Paris's avatar Eric Paris Committed by David S. Miller
Browse files

netfilter: allow hooks to pass error code back up the stack 



SELinux would like to pass certain fatal errors back up the stack.  This patch
implements the generic netfilter support for this functionality.

Based-on-patch-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 37d66800

include/linux/netfilter.h

+2 −0
Original line number Diff line number Diff line
@@ -33,6 +33,8 @@ 


#define NF_QUEUE_NR(x) ((((x) << NF_VERDICT_BITS) & NF_VERDICT_QMASK) | NF_QUEUE)



#define NF_DROP_ERR(x) (((-x) << NF_VERDICT_BITS) | NF_DROP)



/* only for userspace compatibility */

#ifndef __KERNEL__

/* Generic cache responses from hook functions.

net/netfilter/core.c

+4 −2
Original line number Diff line number Diff line
@@ -173,8 +173,10 @@ next_hook: 
			     outdev, &elem, okfn, hook_thresh);

	if (verdict == NF_ACCEPT || verdict == NF_STOP) {

		ret = 1;

	} else if (verdict == NF_DROP) {

	} else if ((verdict & NF_VERDICT_MASK) == NF_DROP) {

		kfree_skb(skb);

		ret = -(verdict >> NF_VERDICT_BITS);

		if (ret == 0)

			ret = -EPERM;

	} else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {

		if (!nf_queue(skb, elem, pf, hook, indev, outdev, okfn,