svn commit: r304282 - stable/11/sys/netpfil/pf

[Kristof Provost]

Author: kp
Date: Wed Aug 17 09:23:40 2016
New Revision: 304282
URL: https://svnweb.freebsd.org/changeset/base/304282

Log:
  MFC r302497:
  
  pf: Map hook returns onto the correct error values
  
  pf returns PF_PASS, PF_DROP, ... in the netpfil hooks, but the hook callers
  expect to get E<foo> error codes.
  Map the returns values. A pass is 0 (everything is OK), anything else means
  pf ate the packet, so return EACCES, which tells the stack not to emit an ICMP
  error message.
  
  PR:     207598

Modified:
  stable/11/sys/netpfil/pf/pf_ioctl.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- stable/11/sys/netpfil/pf/pf_ioctl.c	Wed Aug 17 09:21:55 2016	(r304281)
+++ stable/11/sys/netpfil/pf/pf_ioctl.c	Wed Aug 17 09:23:40 2016	(r304282)
@@ -3563,7 +3563,9 @@ pf_check_in(void *arg, struct mbuf **m, 
 		*m = NULL;
 	}
 
-	return (chk);
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 
 static int
@@ -3578,7 +3580,9 @@ pf_check_out(void *arg, struct mbuf **m,
 		*m = NULL;
 	}
 
-	return (chk);
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 #endif
 
@@ -3601,7 +3605,9 @@ pf_check6_in(void *arg, struct mbuf **m,
 		m_freem(*m);
 		*m = NULL;
 	}
-	return chk;
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 
 static int
@@ -3617,7 +3623,9 @@ pf_check6_out(void *arg, struct mbuf **m
 		m_freem(*m);
 		*m = NULL;
 	}
-	return chk;
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 #endif /* INET6 */