svn commit: r304282 - stable/11/sys/netpfil/pf
Kristof Provost
kp at FreeBSD.org
Wed Aug 17 09:23:42 UTC 2016
Author: kp
Date: Wed Aug 17 09:23:40 2016
New Revision: 304282
URL: https://svnweb.freebsd.org/changeset/base/304282
Log:
MFC r302497:
pf: Map hook returns onto the correct error values
pf returns PF_PASS, PF_DROP, ... in the netpfil hooks, but the hook callers
expect to get E<foo> error codes.
Map the returns values. A pass is 0 (everything is OK), anything else means
pf ate the packet, so return EACCES, which tells the stack not to emit an ICMP
error message.
PR: 207598
Modified:
stable/11/sys/netpfil/pf/pf_ioctl.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- stable/11/sys/netpfil/pf/pf_ioctl.c Wed Aug 17 09:21:55 2016 (r304281)
+++ stable/11/sys/netpfil/pf/pf_ioctl.c Wed Aug 17 09:23:40 2016 (r304282)
@@ -3563,7 +3563,9 @@ pf_check_in(void *arg, struct mbuf **m,
*m = NULL;
}
- return (chk);
+ if (chk != PF_PASS)
+ return (EACCES);
+ return (0);
}
static int
@@ -3578,7 +3580,9 @@ pf_check_out(void *arg, struct mbuf **m,
*m = NULL;
}
- return (chk);
+ if (chk != PF_PASS)
+ return (EACCES);
+ return (0);
}
#endif
@@ -3601,7 +3605,9 @@ pf_check6_in(void *arg, struct mbuf **m,
m_freem(*m);
*m = NULL;
}
- return chk;
+ if (chk != PF_PASS)
+ return (EACCES);
+ return (0);
}
static int
@@ -3617,7 +3623,9 @@ pf_check6_out(void *arg, struct mbuf **m
m_freem(*m);
*m = NULL;
}
- return chk;
+ if (chk != PF_PASS)
+ return (EACCES);
+ return (0);
}
#endif /* INET6 */
More information about the svn-src-stable-11
mailing list