netfilter: allow hooks to pass error code back up the stack
authorEric Paris <eparis@redhat.com>
Tue, 16 Nov 2010 11:52:38 +0000 (11:52 +0000)
committerDavid S. Miller <davem@davemloft.net>
Wed, 17 Nov 2010 18:54:34 +0000 (10:54 -0800)
SELinux would like to pass certain fatal errors back up the stack.  This patch
implements the generic netfilter support for this functionality.

Based-on-patch-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/netfilter.h
net/netfilter/core.c

index 03317c8d4077a6488148b646ee9327b05a7dcec1..1893837b39660821351c4e744a166f0983244f7d 100644 (file)
@@ -33,6 +33,8 @@
 
 #define NF_QUEUE_NR(x) ((((x) << NF_VERDICT_BITS) & NF_VERDICT_QMASK) | NF_QUEUE)
 
+#define NF_DROP_ERR(x) (((-x) << NF_VERDICT_BITS) | NF_DROP)
+
 /* only for userspace compatibility */
 #ifndef __KERNEL__
 /* Generic cache responses from hook functions.
index 85dabb86be6f45dda9b5686466ce487c2b848a5c..32fcbe290c047802942b5d9838489a2193b622b2 100644 (file)
@@ -173,9 +173,11 @@ next_hook:
                             outdev, &elem, okfn, hook_thresh);
        if (verdict == NF_ACCEPT || verdict == NF_STOP) {
                ret = 1;
-       } else if (verdict == NF_DROP) {
+       } else if ((verdict & NF_VERDICT_MASK) == NF_DROP) {
                kfree_skb(skb);
-               ret = -EPERM;
+               ret = -(verdict >> NF_VERDICT_BITS);
+               if (ret == 0)
+                       ret = -EPERM;
        } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
                if (!nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
                              verdict >> NF_VERDICT_BITS))