Author: kp
Date: Sat Jul 9 12:17:01 2016
New Revision: 302497
URL: https://svnweb.freebsd.org/changeset/base/302497
Log:
pf: Map hook returns onto the correct error values
pf returns PF_PASS, PF_DROP, ... in the netpfil hooks, but the hook callers
expect to get E<foo> error codes.
Map the returns values. A pass is 0 (everything is OK), anything else means
pf ate the packet, so return EACCES, which tells the stack not to emit an ICMP
error message.
PR: 207598
Modified:
head/sys/netpfil/pf/pf_ioctl.c
Modified: head/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- head/sys/netpfil/pf/pf_ioctl.c Sat Jul 9 12:10:08 2016
(r302496)
+++ head/sys/netpfil/pf/pf_ioctl.c Sat Jul 9 12:17:01 2016
(r302497)
@@ -3563,7 +3563,9 @@ pf_check_in(void *arg, struct mbuf **m,
*m = NULL;
}
- return (chk);
+ if (chk != PF_PASS)
+ return (EACCES);
+ return (0);
}
static int
@@ -3578,7 +3580,9 @@ pf_check_out(void *arg, struct mbuf **m,
*m = NULL;
}
- return (chk);
+ if (chk != PF_PASS)
+ return (EACCES);
+ return (0);
}
#endif
@@ -3601,7 +3605,9 @@ pf_check6_in(void *arg, struct mbuf **m,
m_freem(*m);
*m = NULL;
}
- return chk;
+ if (chk != PF_PASS)
+ return (EACCES);
+ return (0);
}
static int
@@ -3617,7 +3623,9 @@ pf_check6_out(void *arg, struct mbuf **m
m_freem(*m);
*m = NULL;
}
- return chk;
+ if (chk != PF_PASS)
+ return (EACCES);
+ return (0);
}
#endif /* INET6 */
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
