IPv6 pf_test EACCES

[Alexander Bluhm]

Hi,

A while ago we decided to pass EACCES to uerland if pf blocks a
packet.  IPv6 still has the old EHOSTUNREACH code.

Use the same errno for dropped IPv6 packets as in IPv4.

ok?

bluhm

Index: netinet6/ip6_output.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet6/ip6_output.c,v
retrieving revision 1.247
diff -u -p -r1.247 ip6_output.c
--- netinet6/ip6_output.c       17 Jul 2020 15:21:36 -0000      1.247
+++ netinet6/ip6_output.c       21 Dec 2020 22:27:24 -0000
@@ -616,7 +616,7 @@ reroute:
 
 #if NPF > 0
        if (pf_test(AF_INET6, PF_OUT, ifp, &m) != PF_PASS) {
-               error = EHOSTUNREACH;
+               error = EACCES;
                m_freem(m);
                goto done;
        }
@@ -2773,7 +2773,7 @@ ip6_output_ipsec_send(struct tdb *tdb, s
        if ((encif = enc_getif(tdb->tdb_rdomain, tdb->tdb_tap)) == NULL ||
            pf_test(AF_INET6, fwd ? PF_FWD : PF_OUT, encif, &m) != PF_PASS) {
                m_freem(m);
-               return EHOSTUNREACH;
+               return EACCES;
        }
        if (m == NULL)
                return 0;