From 50999992cf0f5d986485840205b954819cb29f15 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Tue, 16 Nov 2010 11:52:38 +0000 Subject: [PATCH] --- yaml --- r: 224413 b: refs/heads/master c: da6836500414ae734cd9873c2d553db594f831e9 h: refs/heads/master i: 224411: 4f8f0b27dbda12413becc7d90edd1eba815ec208 v: v3 --- [refs] | 2 +- trunk/include/linux/netfilter.h | 2 ++ trunk/net/netfilter/core.c | 6 ++++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/[refs] b/[refs] index 6b8427dfb5c9..3aadac674796 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 37d668004289d202f71dc5bfdadf6c18b34577a2 +refs/heads/master: da6836500414ae734cd9873c2d553db594f831e9 diff --git a/trunk/include/linux/netfilter.h b/trunk/include/linux/netfilter.h index 03317c8d4077..1893837b3966 100644 --- a/trunk/include/linux/netfilter.h +++ b/trunk/include/linux/netfilter.h @@ -33,6 +33,8 @@ #define NF_QUEUE_NR(x) ((((x) << NF_VERDICT_BITS) & NF_VERDICT_QMASK) | NF_QUEUE) +#define NF_DROP_ERR(x) (((-x) << NF_VERDICT_BITS) | NF_DROP) + /* only for userspace compatibility */ #ifndef __KERNEL__ /* Generic cache responses from hook functions. diff --git a/trunk/net/netfilter/core.c b/trunk/net/netfilter/core.c index 85dabb86be6f..32fcbe290c04 100644 --- a/trunk/net/netfilter/core.c +++ b/trunk/net/netfilter/core.c @@ -173,9 +173,11 @@ int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb, outdev, &elem, okfn, hook_thresh); if (verdict == NF_ACCEPT || verdict == NF_STOP) { ret = 1; - } else if (verdict == NF_DROP) { + } else if ((verdict & NF_VERDICT_MASK) == NF_DROP) { kfree_skb(skb); - ret = -EPERM; + ret = -(verdict >> NF_VERDICT_BITS); + if (ret == 0) + ret = -EPERM; } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) { if (!nf_queue(skb, elem, pf, hook, indev, outdev, okfn, verdict >> NF_VERDICT_BITS))