svn commit: r304283 - stable/10/sys/netpfil/pf

[Kristof Provost]

Author: kp
Date: Wed Aug 17 09:24:46 2016
New Revision: 304283
URL: https://svnweb.freebsd.org/changeset/base/304283

Log:
  MFC r302497:
  
  pf: Map hook returns onto the correct error values
  
  pf returns PF_PASS, PF_DROP, ... in the netpfil hooks, but the hook callers
  expect to get E<foo> error codes.
  Map the returns values. A pass is 0 (everything is OK), anything else means
  pf ate the packet, so return EACCES, which tells the stack not to emit an ICMP
  error message.
  
  PR:     207598

Modified:
  stable/10/sys/netpfil/pf/pf_ioctl.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- stable/10/sys/netpfil/pf/pf_ioctl.c Wed Aug 17 09:23:40 2016        
(r304282)
+++ stable/10/sys/netpfil/pf/pf_ioctl.c Wed Aug 17 09:24:46 2016        
(r304283)
@@ -3554,7 +3554,9 @@ pf_check_in(void *arg, struct mbuf **m, 
                *m = NULL;
        }
 
-       return (chk);
+       if (chk != PF_PASS)
+               return (EACCES);
+       return (0);
 }
 
 static int
@@ -3569,7 +3571,9 @@ pf_check_out(void *arg, struct mbuf **m,
                *m = NULL;
        }
 
-       return (chk);
+       if (chk != PF_PASS)
+               return (EACCES);
+       return (0);
 }
 #endif
 
@@ -3592,7 +3596,9 @@ pf_check6_in(void *arg, struct mbuf **m,
                m_freem(*m);
                *m = NULL;
        }
-       return chk;
+       if (chk != PF_PASS)
+               return (EACCES);
+       return (0);
 }
 
 static int
@@ -3608,7 +3614,9 @@ pf_check6_out(void *arg, struct mbuf **m
                m_freem(*m);
                *m = NULL;
        }
-       return chk;
+       if (chk != PF_PASS)
+               return (EACCES);
+       return (0);
 }
 #endif /* INET6 */
 
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"