Commit cf8b7c1a authored by Florian Westphal's avatar Florian Westphal
Browse files

netfilter: bridge: convert br_netfilter to NF_DROP_REASON 



errno is 0 because these hooks are called from prerouting and forward.
There is no socket that the errno would ever be propagated to.

Other netfilter modules (e.g. nf_nat, conntrack, ...) can be converted
in a similar way.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent e0d45931

net/bridge/br_netfilter_hooks.c

+13 −13
Original line number Diff line number Diff line
@@ -486,11 +486,11 @@ static unsigned int br_nf_pre_routing(void *priv, 
	struct brnf_net *brnet;



	if (unlikely(!pskb_may_pull(skb, len)))

		return NF_DROP;

		return NF_DROP_REASON(skb, SKB_DROP_REASON_PKT_TOO_SMALL, 0);



	p = br_port_get_rcu(state->in);

	if (p == NULL)

		return NF_DROP;

		return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0);

	br = p->br;



	brnet = net_generic(state->net, brnf_net_id);
@@ -501,7 +501,7 @@ static unsigned int br_nf_pre_routing(void *priv, 
			return NF_ACCEPT;

		if (!ipv6_mod_enabled()) {

			pr_warn_once("Module ipv6 is disabled, so call_ip6tables is not supported.");

			return NF_DROP;

			return NF_DROP_REASON(skb, SKB_DROP_REASON_IPV6DISABLED, 0);

		}



		nf_bridge_pull_encap_header_rcsum(skb);
@@ -518,12 +518,12 @@ static unsigned int br_nf_pre_routing(void *priv, 
	nf_bridge_pull_encap_header_rcsum(skb);



	if (br_validate_ipv4(state->net, skb))

		return NF_DROP;

		return NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0);



	if (!nf_bridge_alloc(skb))

		return NF_DROP;

		return NF_DROP_REASON(skb, SKB_DROP_REASON_NOMEM, 0);

	if (!setup_pre_routing(skb, state->net))

		return NF_DROP;

		return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0);



	nf_bridge = nf_bridge_info_get(skb);

	nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr;
@@ -590,15 +590,15 @@ static unsigned int br_nf_forward_ip(void *priv, 
	/* Need exclusive nf_bridge_info since we might have multiple

	 * different physoutdevs. */

	if (!nf_bridge_unshare(skb))

		return NF_DROP;

		return NF_DROP_REASON(skb, SKB_DROP_REASON_NOMEM, 0);



	nf_bridge = nf_bridge_info_get(skb);

	if (!nf_bridge)

		return NF_DROP;

		return NF_DROP_REASON(skb, SKB_DROP_REASON_NOMEM, 0);



	parent = bridge_parent(state->out);

	if (!parent)

		return NF_DROP;

		return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0);



	if (IS_IP(skb) || is_vlan_ip(skb, state->net) ||

	    is_pppoe_ip(skb, state->net))
@@ -618,13 +618,13 @@ static unsigned int br_nf_forward_ip(void *priv, 


	if (pf == NFPROTO_IPV4) {

		if (br_validate_ipv4(state->net, skb))

			return NF_DROP;

			return NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0);

		IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;

	}



	if (pf == NFPROTO_IPV6) {

		if (br_validate_ipv6(state->net, skb))

			return NF_DROP;

			return NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0);

		IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;

	}
@@ -666,7 +666,7 @@ static unsigned int br_nf_forward_arp(void *priv, 
	}



	if (unlikely(!pskb_may_pull(skb, sizeof(struct arphdr))))

		return NF_DROP;

		return NF_DROP_REASON(skb, SKB_DROP_REASON_PKT_TOO_SMALL, 0);



	if (arp_hdr(skb)->ar_pln != 4) {

		if (is_vlan_arp(skb, state->net))
@@ -831,7 +831,7 @@ static unsigned int br_nf_post_routing(void *priv, 
		return NF_ACCEPT;



	if (!realoutdev)

		return NF_DROP;

		return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0);



	if (IS_IP(skb) || is_vlan_ip(skb, state->net) ||

	    is_pppoe_ip(skb, state->net))

net/bridge/br_netfilter_ipv6.c

+3 −3
Original line number Diff line number Diff line
@@ -161,13 +161,13 @@ unsigned int br_nf_pre_routing_ipv6(void *priv, 
	struct nf_bridge_info *nf_bridge;



	if (br_validate_ipv6(state->net, skb))

		return NF_DROP;

		return NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0);



	nf_bridge = nf_bridge_alloc(skb);

	if (!nf_bridge)

		return NF_DROP;

		return NF_DROP_REASON(skb, SKB_DROP_REASON_NOMEM, 0);

	if (!setup_pre_routing(skb, state->net))

		return NF_DROP;

		return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0);



	nf_bridge = nf_bridge_info_get(skb);

	nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;