Attachment 171268 Details for Bug 207598 – pf error returns

[patch] pf error returns

207598.patch (text/plain), 1.47 KB, created by Kristof Provost on 2016-06-10 14:35:24 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kristof Provost

Created: 2016-06-10 14:35:24 UTC

Size: 1.47 KB

patch

obsolete

>commit 61d236ad6cb89bc3edd77507018c65156cafd421
>Author: Kristof Provost <kristof@codepro.be>
>Date:   Fri Jun 10 16:29:32 2016 +0200
>
>    pf: Map hook returns onto the correct error values
>    
>    pf returns PF_PASS, PF_DROP, ... in the netpfil hooks, but the hook callers
>    expect to get E<foo> error codes.
>    Map the returns values. A pass is 0 (everything is OK), anything else means
>    pf ate the packet, so return EACCES, which tells the stack not to emit an ICMP
>    error message.
>    
>    PR:	207598
>
>diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
>index 3291c9b..534bfad 100644
>--- a/sys/netpfil/pf/pf_ioctl.c
>+++ b/sys/netpfil/pf/pf_ioctl.c
>@@ -3562,7 +3562,9 @@ pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
> 		*m = NULL;
> 	}
> 
>-	return (chk);
>+	if (chk != PF_PASS)
>+		return (EACCES);
>+	return (0);
> }
> 
> static int
>@@ -3577,7 +3579,9 @@ pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
> 		*m = NULL;
> 	}
> 
>-	return (chk);
>+	if (chk != PF_PASS)
>+		return (EACCES);
>+	return (0);
> }
> #endif
> 
>@@ -3600,7 +3604,9 @@ pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
> 		m_freem(*m);
> 		*m = NULL;
> 	}
>-	return chk;
>+	if (chk != PF_PASS)
>+		return (EACCES);
>+	return (0);
> }
> 
> static int
>@@ -3616,7 +3622,9 @@ pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
> 		m_freem(*m);
> 		*m = NULL;
> 	}
>-	return chk;
>+	if (chk != PF_PASS)
>+		return (EACCES);
>+	return (0);
> }
> #endif /* INET6 */
>

Actions: View | Diff

Attachments on bug 207598: 170591 | 170747 | 171268