---

yaml --- r: 224413 b: refs/heads/master c: da68365 h: refs/heads/master i: 224411: 4f8f0b2 v: v3
git-mirror · Nov 17, 2010 · 5099999 · 5099999
1 parent 1023ce7
commit 5099999
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 3 deletions.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 37d668004289d202f71dc5bfdadf6c18b34577a2
+refs/heads/master: da6836500414ae734cd9873c2d553db594f831e9
diff --git a/trunk/include/linux/netfilter.h b/trunk/include/linux/netfilter.h
@@ -33,6 +33,8 @@
 
 #define NF_QUEUE_NR(x) ((((x) << NF_VERDICT_BITS) & NF_VERDICT_QMASK) | NF_QUEUE)
 
+#define NF_DROP_ERR(x) (((-x) << NF_VERDICT_BITS) | NF_DROP)
+
 /* only for userspace compatibility */
 #ifndef __KERNEL__
 /* Generic cache responses from hook functions.

diff --git a/trunk/net/netfilter/core.c b/trunk/net/netfilter/core.c
@@ -173,9 +173,11 @@ int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
 			     outdev, &elem, okfn, hook_thresh);
 	if (verdict == NF_ACCEPT || verdict == NF_STOP) {
 		ret = 1;
-	} else if (verdict == NF_DROP) {
+	} else if ((verdict & NF_VERDICT_MASK) == NF_DROP) {
 		kfree_skb(skb);
-		ret = -EPERM;
+		ret = -(verdict >> NF_VERDICT_BITS);
+		if (ret == 0)
+			ret = -EPERM;
 	} else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
 		if (!nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
 			      verdict >> NF_VERDICT_BITS))