GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-27 00:51:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

netfilter: use switch() to handle verdict cases from nf_hook_slow()

Browse source 
Use switch() for verdict handling and add explicit handling for
NF_STOLEN and other non-conventional verdicts.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2016-11-03 10:56:30 +01:00
parent 0e5a1c7eb3
commit c63cbc4604
1 changed files with 14 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

18
net/netfilter/core.c
View file

@ -328,22 +328,32 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state)
{ {
struct nf_hook_entry *entry; struct nf_hook_entry *entry;
unsigned int verdict; unsigned int verdict;
int ret = 0; int ret;
entry = rcu_dereference(state->hook_entries); entry = rcu_dereference(state->hook_entries);
next_hook: next_hook:
verdict = nf_iterate(skb, state, &entry); verdict = nf_iterate(skb, state, &entry);
if (verdict == NF_ACCEPT) { switch (verdict & NF_VERDICT_MASK) {
case NF_ACCEPT:
ret = 1; ret = 1;
} else if ((verdict & NF_VERDICT_MASK) == NF_DROP) { break;
case NF_DROP:
kfree_skb(skb); kfree_skb(skb);
ret = NF_DROP_GETERR(verdict); ret = NF_DROP_GETERR(verdict);
if (ret == 0) if (ret == 0)
ret = -EPERM; ret = -EPERM;
} else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) { break;
case NF_QUEUE:
ret = nf_queue(skb, state, &entry, verdict); ret = nf_queue(skb, state, &entry, verdict);
if (ret == 1 && entry) if (ret == 1 && entry)
goto next_hook; goto next_hook;
/* Fall through. */
default:
/* Implicit handling for NF_STOLEN, as well as any other non
* conventional verdicts.
*/
ret = 0;
break;
} }
return ret; return ret;
} }