diff options
| author | Florian Westphal <fw@strlen.de> | 2011-01-18 15:52:14 +0100 |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2011-01-18 15:52:14 +0100 |
| commit | f615df76ed862b7d3927ec5f55b805ca19be29d9 (patch) | |
| tree | 11d8dca165f2b44cfe31e39eacf52d2d899ffbcf /net | |
| parent | 06cdb6349c1f3fd439398dbc04ce4c696f0a41ab (diff) | |
| download | linux-3.10-f615df76ed862b7d3927ec5f55b805ca19be29d9.tar.gz linux-3.10-f615df76ed862b7d3927ec5f55b805ca19be29d9.tar.bz2 linux-3.10-f615df76ed862b7d3927ec5f55b805ca19be29d9.zip | |
netfilter: reduce NF_VERDICT_MASK to 0xff
NF_VERDICT_MASK is currently 0xffff. This is because the upper
16 bits are used to store errno (for NF_DROP) or the queue number
(NF_QUEUE verdict).
As there are up to 0xffff different queues available, there is no more
room to store additional flags.
At the moment there are only 6 different verdicts, i.e. we can reduce
NF_VERDICT_MASK to 0xff to allow storing additional flags in the 0xff00 space.
NF_VERDICT_BITS would then be reduced to 8, but because the value is
exported to userspace, this might cause breakage; e.g.:
e.g. 'queuenr = (1 << NF_VERDICT_BITS) | NF_QUEUE' would now break.
Thus, remove NF_VERDICT_BITS usage in the kernel and move the old value
to the 'userspace compat' section.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/core.c | 4 | ||||
| -rw-r--r-- | net/netfilter/nf_queue.c | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/net/netfilter/core.c b/net/netfilter/core.c index 0c5b796ef52..4d88e45b978 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -175,12 +175,12 @@ next_hook: ret = 1; } else if ((verdict & NF_VERDICT_MASK) == NF_DROP) { kfree_skb(skb); - ret = -(verdict >> NF_VERDICT_BITS); + ret = NF_DROP_GETERR(verdict); if (ret == 0) ret = -EPERM; } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) { ret = nf_queue(skb, elem, pf, hook, indev, outdev, okfn, - verdict >> NF_VERDICT_BITS); + verdict >> NF_VERDICT_QBITS); if (ret < 0) { if (ret == -ECANCELED) goto next_hook; diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c index 5c4b730a2e6..ce1150d4a3f 100644 --- a/net/netfilter/nf_queue.c +++ b/net/netfilter/nf_queue.c @@ -299,7 +299,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict) case NF_QUEUE: err = __nf_queue(skb, elem, entry->pf, entry->hook, entry->indev, entry->outdev, entry->okfn, - verdict >> NF_VERDICT_BITS); + verdict >> NF_VERDICT_QBITS); if (err < 0) { if (err == -ECANCELED) goto next_hook; |