From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 51/51] netfilter: nat: propagate errors from xfrm_me_harder()
Date: Sat, 6 Apr 2013 14:17:50 +0200 [thread overview]
Message-ID: <1365250670-14993-52-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1365250670-14993-1-git-send-email-pablo@netfilter.org>
From: Patrick McHardy <kaber@trash.net>
Propagate errors from ip_xfrm_me_harder() instead of returning EPERM in
all cases.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/ipv4/netfilter/iptable_nat.c | 17 +++++++++++------
net/ipv6/netfilter/ip6table_nat.c | 17 +++++++++++------
net/netfilter/nf_nat_core.c | 9 +++++----
3 files changed, 27 insertions(+), 16 deletions(-)
diff --git a/net/ipv4/netfilter/iptable_nat.c b/net/ipv4/netfilter/iptable_nat.c
index c2937c8..6383273 100644
--- a/net/ipv4/netfilter/iptable_nat.c
+++ b/net/ipv4/netfilter/iptable_nat.c
@@ -176,6 +176,7 @@ nf_nat_ipv4_out(unsigned int hooknum,
#ifdef CONFIG_XFRM
const struct nf_conn *ct;
enum ip_conntrack_info ctinfo;
+ int err;
#endif
unsigned int ret;
@@ -195,9 +196,11 @@ nf_nat_ipv4_out(unsigned int hooknum,
ct->tuplehash[!dir].tuple.dst.u3.ip) ||
(ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
ct->tuplehash[dir].tuple.src.u.all !=
- ct->tuplehash[!dir].tuple.dst.u.all))
- if (nf_xfrm_me_harder(skb, AF_INET) < 0)
- ret = NF_DROP;
+ ct->tuplehash[!dir].tuple.dst.u.all)) {
+ err = nf_xfrm_me_harder(skb, AF_INET);
+ if (err < 0)
+ ret = NF_DROP_ERR(err);
+ }
}
#endif
return ret;
@@ -235,9 +238,11 @@ nf_nat_ipv4_local_fn(unsigned int hooknum,
else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
ct->tuplehash[dir].tuple.dst.u.all !=
- ct->tuplehash[!dir].tuple.src.u.all)
- if (nf_xfrm_me_harder(skb, AF_INET) < 0)
- ret = NF_DROP;
+ ct->tuplehash[!dir].tuple.src.u.all) {
+ err = nf_xfrm_me_harder(skb, AF_INET);
+ if (err < 0)
+ ret = NF_DROP_ERR(err);
+ }
#endif
}
return ret;
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
index 97e2edd..6383f90 100644
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -179,6 +179,7 @@ nf_nat_ipv6_out(unsigned int hooknum,
#ifdef CONFIG_XFRM
const struct nf_conn *ct;
enum ip_conntrack_info ctinfo;
+ int err;
#endif
unsigned int ret;
@@ -197,9 +198,11 @@ nf_nat_ipv6_out(unsigned int hooknum,
&ct->tuplehash[!dir].tuple.dst.u3) ||
(ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
ct->tuplehash[dir].tuple.src.u.all !=
- ct->tuplehash[!dir].tuple.dst.u.all))
- if (nf_xfrm_me_harder(skb, AF_INET6) < 0)
- ret = NF_DROP;
+ ct->tuplehash[!dir].tuple.dst.u.all)) {
+ err = nf_xfrm_me_harder(skb, AF_INET6);
+ if (err < 0)
+ ret = NF_DROP_ERR(err);
+ }
}
#endif
return ret;
@@ -236,9 +239,11 @@ nf_nat_ipv6_local_fn(unsigned int hooknum,
else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
ct->tuplehash[dir].tuple.dst.u.all !=
- ct->tuplehash[!dir].tuple.src.u.all)
- if (nf_xfrm_me_harder(skb, AF_INET6))
- ret = NF_DROP;
+ ct->tuplehash[!dir].tuple.src.u.all) {
+ err = nf_xfrm_me_harder(skb, AF_INET6);
+ if (err < 0)
+ ret = NF_DROP_ERR(err);
+ }
#endif
}
return ret;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 8d5769c..346f871 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -87,9 +87,10 @@ int nf_xfrm_me_harder(struct sk_buff *skb, unsigned int family)
struct flowi fl;
unsigned int hh_len;
struct dst_entry *dst;
+ int err;
- if (xfrm_decode_session(skb, &fl, family) < 0)
- return -1;
+ err = xfrm_decode_session(skb, &fl, family);
+ return err;
dst = skb_dst(skb);
if (dst->xfrm)
@@ -98,7 +99,7 @@ int nf_xfrm_me_harder(struct sk_buff *skb, unsigned int family)
dst = xfrm_lookup(dev_net(dst->dev), dst, &fl, skb->sk, 0);
if (IS_ERR(dst))
- return -1;
+ return PTR_ERR(dst);
skb_dst_drop(skb);
skb_dst_set(skb, dst);
@@ -107,7 +108,7 @@ int nf_xfrm_me_harder(struct sk_buff *skb, unsigned int family)
hh_len = skb_dst(skb)->dev->hard_header_len;
if (skb_headroom(skb) < hh_len &&
pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
- return -1;
+ return -ENOMEM;
return 0;
}
EXPORT_SYMBOL(nf_xfrm_me_harder);
--
1.7.10.4
next prev parent reply other threads:[~2013-04-06 12:17 UTC|newest]
Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-04-06 12:16 [PATCH 00/51] netfilter updates for net-next Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 01/51] ipvs: avoid routing by TOS for real server Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 02/51] ipvs: prefer NETDEV_DOWN event to free cached dsts Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 03/51] ipvs: convert the IP_VS_XMIT macros to functions Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 04/51] ipvs: rename functions related to dst_cache reset Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 05/51] ipvs: no need to reroute anymore on DNAT over loopback Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 06/51] ipvs: do not use skb_share_check Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 07/51] ipvs: consolidate all dst checks on transmit in one place Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 08/51] ipvs: optimize dst usage for real server Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 09/51] ipvs: convert app locks Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 10/51] ipvs: remove rs_lock by using RCU Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 11/51] ipvs: convert locks used in persistence engines Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 12/51] ipvs: convert connection locking Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 13/51] ipvs: reorder keys in connection structure Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 14/51] ipvs: avoid kmem_cache_zalloc in ip_vs_conn_new Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 15/51] ipvs: change ip_vs_sched_lock to mutex Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 16/51] ipvs: preparations for using rcu in schedulers Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 17/51] ipvs: add ip_vs_dest_hold and ip_vs_dest_put Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 18/51] ipvs: convert dh scheduler to rcu Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 19/51] ipvs: convert lblc " Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 20/51] ipvs: convert lblcr " Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 21/51] ipvs: convert lc " Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 22/51] ipvs: convert nq " Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 23/51] ipvs: convert rr " Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 24/51] ipvs: convert sed " Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 25/51] ipvs: convert sh " Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 26/51] ipvs: convert wlc " Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 27/51] ipvs: convert wrr " Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 28/51] ipvs: reorganize dest trash Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 29/51] ipvs: do not expect result from done_service Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 30/51] ipvs: convert sched_lock to spin lock Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 31/51] ipvs: convert dests to rcu Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 32/51] ipvs: convert services " Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 33/51] ipvs: do not disable bh for long time Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 34/51] netfilter: use IS_ENABLE to replace if defined in TRACE target Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 35/51] netfilter: xt_NFQUEUE: introduce CPU fanout Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 36/51] netfilter: xt_NFQUEUE: coalesce IPv4 and IPv6 hashing Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 37/51] netfilter: fix struct ip6t_frag field description Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 38/51] netfilter: make /proc/net/netfilter pernet Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 39/51] netfilter: nf_log: prepare net namespace support for loggers Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 40/51] netfilter: ebt_log: add net namespace support for ebt_log Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 41/51] netfilter: xt_LOG: add net namespace support for xt_LOG Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 42/51] netfilter: ebt_ulog: add net namespace support for ebt_ulog Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 43/51] netfilter: ipt_ULOG: add net namespace support for ipt_ULOG Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 44/51] netfilter: nfnetlink_log: add net namespace support for nfnetlink_log Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 45/51] netfilter: enable per netns support for nf_loggers Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 46/51] netfilter: nfnetlink_queue: add net namespace support for nfnetlink_queue Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 47/51] netfilter: remove unneeded variable proc_net_netfilter Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 48/51] netfilter: implement RFC3168 5.3 (ecn protection) for ipv6 fragmentation handling Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 49/51] netfilter: ipv4: propagate routing errors from ip_route_me_harder() Pablo Neira Ayuso
2013-04-06 12:17 ` [PATCH 50/51] netfilter: ipv6: propagate routing errors from ip6_route_me_harder() Pablo Neira Ayuso
2013-04-06 12:17 ` Pablo Neira Ayuso [this message]
2013-04-06 13:14 ` [PATCH 00/51] netfilter updates for net-next Julian Anastasov
2013-04-06 13:52 ` Pablo Neira Ayuso
2013-04-07 16:27 ` David Miller
2013-04-08 16:06 ` Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1365250670-14993-52-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).