svn commit: r302497 - head/sys/netpfil/pf

[Kristof Provost]

Author: kp
Date: Sat Jul  9 12:17:01 2016
New Revision: 302497
URL: https://svnweb.freebsd.org/changeset/base/302497

Log:
  pf: Map hook returns onto the correct error values
  
  pf returns PF_PASS, PF_DROP, ... in the netpfil hooks, but the hook callers
  expect to get E<foo> error codes.
  Map the returns values. A pass is 0 (everything is OK), anything else means
  pf ate the packet, so return EACCES, which tells the stack not to emit an ICMP
  error message.
  
  PR:	207598

Modified:
  head/sys/netpfil/pf/pf_ioctl.c

Modified: head/sys/netpfil/pf/pf_ioctl.c
==============================================================================
--- head/sys/netpfil/pf/pf_ioctl.c	Sat Jul  9 12:10:08 2016	(r302496)
+++ head/sys/netpfil/pf/pf_ioctl.c	Sat Jul  9 12:17:01 2016	(r302497)
@@ -3563,7 +3563,9 @@ pf_check_in(void *arg, struct mbuf **m, 
 		*m = NULL;
 	}
 
-	return (chk);
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 
 static int
@@ -3578,7 +3580,9 @@ pf_check_out(void *arg, struct mbuf **m,
 		*m = NULL;
 	}
 
-	return (chk);
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 #endif
 
@@ -3601,7 +3605,9 @@ pf_check6_in(void *arg, struct mbuf **m,
 		m_freem(*m);
 		*m = NULL;
 	}
-	return chk;
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 
 static int
@@ -3617,7 +3623,9 @@ pf_check6_out(void *arg, struct mbuf **m
 		m_freem(*m);
 		*m = NULL;
 	}
-	return chk;
+	if (chk != PF_PASS)
+		return (EACCES);
+	return (0);
 }
 #endif /* INET6 */