[NETFILTER 01/06]: nf_queue: handle NF_STOP and unknown verdicts in nf_reinject

[Patrick McHardy <kaber@trash.net>]

[NETFILTER]: nf_queue: handle NF_STOP and unknown verdicts in nf_reinject

In case of an unknown verdict or NF_STOP the packet leaks. Unknown verdicts
can happen when userspace is buggy. Reinject the packet in case of NF_STOP,
drop on unknown verdicts.

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit 559fa54b6c0d2813de1d4753964587fc3655bbf1
tree b160176d29bdf8ff93cf6491533e41104fa19f93
parent 440848a8e33fc1927bab45bd73f6c8e042ea7abd
author Patrick McHardy <kaber@trash.net> Tue, 25 Jul 2006 00:02:11 +0200
committer Patrick McHardy <kaber@trash.net> Tue, 25 Jul 2006 00:02:11 +0200

 net/netfilter/nf_queue.c |    9 ++++-----
 1 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index bb6fcee..662a869 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -219,21 +219,20 @@ #endif
 
 	switch (verdict & NF_VERDICT_MASK) {
 	case NF_ACCEPT:
+	case NF_STOP:
 		info->okfn(skb);
+	case NF_STOLEN:
 		break;
-
 	case NF_QUEUE:
 		if (!nf_queue(&skb, elem, info->pf, info->hook, 
 			      info->indev, info->outdev, info->okfn,
 			      verdict >> NF_VERDICT_BITS))
 			goto next_hook;
 		break;
+	default:
+		kfree_skb(skb);
 	}
 	rcu_read_unlock();
-
-	if (verdict == NF_DROP)
-		kfree_skb(skb);
-
 	kfree(info);
 	return;
 }