• Florian Westphal's avatar
    netfilter: ingress: translate 0 nf_hook_slow retval to -1 · df122f58
    Florian Westphal authored
    The caller assumes that < 0 means that skb was stolen (or free'd).
    All other return values continue skb processing.
    nf_hook_slow returns 3 different return value types:
    A) a (negative) errno value: the skb was dropped (NF_DROP, e.g.
    by iptables '-j DROP' rule).
    B) 0. The skb was stolen by the hook or queued to userspace.
    C) 1. all hooks returned NF_ACCEPT so the caller should invoke
       the okfn so packet processing can continue.
    nft ingress facility currently doesn't have the 'okfn' that
    the NF_HOOK() macros use; there is no nfqueue support either.
    So 1 means that nf_hook_ingress() caller should go on processing the skb.
    In order to allow use of NF_STOLEN from ingress we need to translate
    this to an errno number, else we'd crash because we continue with
    already-free'd (or about to be free-d) skb.
    The errno value isn't checked, its just important that its less than 0,
    so return -1.
    Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
netfilter_ingress.h 1.39 KB