svn commit: r304283 - stable/10/sys/netpfil/pf

[Kristof Provost]

Author: kp
Date: Wed Aug 17 09:24:46 2016
New Revision: 304283
URL: https://svnweb.freebsd.org/changeset/base/304283

Log:
  MFC r302497:
  
  pf: Map hook returns onto the correct error values
  
  pf returns PF_PASS, PF_DROP, ... in the netpfil hooks, but the hook callers
  expect to get E<foo> error codes.
  Map the returns values. A pass is 0 (everything is OK), anything else means
  pf ate the packet, so return EACCES, which tells the stack not to emit an ICMP
  error message.
  
  PR:     207598

Modified:
  stable/10/sys/netpfil/pf/pf_ioctl.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- stable/10/sys/netpfil/pf/pf_ioctl.c	Wed Aug 17 09:23:40 2016	(r304282)
+++ stable/10/sys/netpfil/pf/pf_ioctl.c	Wed Aug 17 09:24:46 2016	(r304283)
@@ -3554,7 +3554,9 @@ pf_check_in(void *arg, struct mbuf **m, 
 		*m = NULL;
 	}
 
-	return (chk);
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 
 static int
@@ -3569,7 +3571,9 @@ pf_check_out(void *arg, struct mbuf **m,
 		*m = NULL;
 	}
 
-	return (chk);
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 #endif
 
@@ -3592,7 +3596,9 @@ pf_check6_in(void *arg, struct mbuf **m,
 		m_freem(*m);
 		*m = NULL;
 	}
-	return chk;
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 
 static int
@@ -3608,7 +3614,9 @@ pf_check6_out(void *arg, struct mbuf **m
 		m_freem(*m);
 		*m = NULL;
 	}
-	return chk;
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 #endif /* INET6 */