From: kaber@trash.net
To: davem@davemloft.net
Cc: netfilter-devel@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH 72/79] netfilter: nfnetlink_queue: return error number to caller
Date: Wed, 19 Jan 2011 20:15:12 +0100 [thread overview]
Message-ID: <1295464519-21763-73-git-send-email-kaber@trash.net> (raw)
In-Reply-To: <1295464519-21763-1-git-send-email-kaber@trash.net>
From: Florian Westphal <fw@strlen.de>
instead of returning -1 on error, return an error number to allow the
caller to handle some errors differently.
ECANCELED is used to indicate that the hook is going away and should be
ignored.
A followup patch will introduce more 'ignore this hook' conditions,
(depending on queue settings) and will move kfree_skb responsibility
to the caller.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
---
net/netfilter/core.c | 6 +++-
net/netfilter/nf_queue.c | 44 +++++++++++++++++++++++++++-----------
net/netfilter/nfnetlink_queue.c | 22 ++++++++++++-------
3 files changed, 49 insertions(+), 23 deletions(-)
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index e69d537..91d66d2f 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -179,9 +179,11 @@ next_hook:
if (ret == 0)
ret = -EPERM;
} else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
- if (!nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
- verdict >> NF_VERDICT_BITS))
+ ret = nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
+ verdict >> NF_VERDICT_BITS);
+ if (ret == -ECANCELED)
goto next_hook;
+ ret = 0;
}
rcu_read_unlock();
return ret;
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 1876f74..ad25c7e 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -125,7 +125,7 @@ static int __nf_queue(struct sk_buff *skb,
int (*okfn)(struct sk_buff *),
unsigned int queuenum)
{
- int status;
+ int status = -ENOENT;
struct nf_queue_entry *entry = NULL;
#ifdef CONFIG_BRIDGE_NETFILTER
struct net_device *physindev;
@@ -146,8 +146,10 @@ static int __nf_queue(struct sk_buff *skb,
goto err_unlock;
entry = kmalloc(sizeof(*entry) + afinfo->route_key_size, GFP_ATOMIC);
- if (!entry)
+ if (!entry) {
+ status = -ENOMEM;
goto err_unlock;
+ }
*entry = (struct nf_queue_entry) {
.skb = skb,
@@ -163,9 +165,8 @@ static int __nf_queue(struct sk_buff *skb,
if (!try_module_get(entry->elem->owner)) {
rcu_read_unlock();
kfree(entry);
- return 0;
+ return -ECANCELED;
}
-
/* Bump dev refs so they don't vanish while packet is out */
if (indev)
dev_hold(indev);
@@ -192,14 +193,14 @@ static int __nf_queue(struct sk_buff *skb,
goto err;
}
- return 1;
+ return 0;
err_unlock:
rcu_read_unlock();
err:
kfree_skb(skb);
kfree(entry);
- return 1;
+ return status;
}
int nf_queue(struct sk_buff *skb,
@@ -211,6 +212,8 @@ int nf_queue(struct sk_buff *skb,
unsigned int queuenum)
{
struct sk_buff *segs;
+ int err;
+ unsigned int queued;
if (!skb_is_gso(skb))
return __nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
@@ -227,19 +230,32 @@ int nf_queue(struct sk_buff *skb,
segs = skb_gso_segment(skb, 0);
kfree_skb(skb);
+ /* Does not use PTR_ERR to limit the number of error codes that can be
+ * returned by nf_queue. For instance, callers rely on -ECANCELED to mean
+ * 'ignore this hook'.
+ */
if (IS_ERR(segs))
- return 1;
+ return -EINVAL;
+ queued = 0;
+ err = 0;
do {
struct sk_buff *nskb = segs->next;
segs->next = NULL;
- if (!__nf_queue(segs, elem, pf, hook, indev, outdev, okfn,
- queuenum))
+ if (err == 0)
+ err = __nf_queue(segs, elem, pf, hook, indev,
+ outdev, okfn, queuenum);
+ if (err == 0)
+ queued++;
+ else
kfree_skb(segs);
segs = nskb;
} while (segs);
- return 1;
+
+ if (unlikely(err && queued))
+ err = 0;
+ return err;
}
void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
@@ -247,6 +263,7 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
struct sk_buff *skb = entry->skb;
struct list_head *elem = &entry->elem->list;
const struct nf_afinfo *afinfo;
+ int err;
rcu_read_lock();
@@ -280,9 +297,10 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
local_bh_enable();
break;
case NF_QUEUE:
- if (!__nf_queue(skb, elem, entry->pf, entry->hook,
- entry->indev, entry->outdev, entry->okfn,
- verdict >> NF_VERDICT_BITS))
+ err = __nf_queue(skb, elem, entry->pf, entry->hook,
+ entry->indev, entry->outdev, entry->okfn,
+ verdict >> NF_VERDICT_BITS);
+ if (err == -ECANCELED)
goto next_hook;
break;
case NF_STOLEN:
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 68e67d1..b83123f 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -387,25 +387,31 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
{
struct sk_buff *nskb;
struct nfqnl_instance *queue;
- int err;
+ int err = -ENOBUFS;
/* rcu_read_lock()ed by nf_hook_slow() */
queue = instance_lookup(queuenum);
- if (!queue)
+ if (!queue) {
+ err = -ESRCH;
goto err_out;
+ }
- if (queue->copy_mode == NFQNL_COPY_NONE)
+ if (queue->copy_mode == NFQNL_COPY_NONE) {
+ err = -EINVAL;
goto err_out;
+ }
nskb = nfqnl_build_packet_message(queue, entry);
- if (nskb == NULL)
+ if (nskb == NULL) {
+ err = -ENOMEM;
goto err_out;
-
+ }
spin_lock_bh(&queue->lock);
- if (!queue->peer_pid)
+ if (!queue->peer_pid) {
+ err = -EINVAL;
goto err_out_free_nskb;
-
+ }
if (queue->queue_total >= queue->queue_maxlen) {
queue->queue_dropped++;
if (net_ratelimit())
@@ -432,7 +438,7 @@ err_out_free_nskb:
err_out_unlock:
spin_unlock_bh(&queue->lock);
err_out:
- return -1;
+ return err;
}
static int
--
1.7.2.3
next prev parent reply other threads:[~2011-01-19 19:15 UTC|newest]
Thread overview: 89+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-01-19 19:14 [PATCH 00/79] netfilter: netfilter update kaber
2011-01-19 19:14 ` [PATCH 01/79] netfilter: nf_conntrack: don't always initialize ct->proto kaber
2011-01-19 19:14 ` [PATCH 02/79] netfilter: xt_NFQUEUE: remove modulo operations kaber
2011-01-19 19:14 ` [PATCH 03/79] netfilter: xt_LOG: do print MAC header on FORWARD kaber
2011-01-19 19:14 ` [PATCH 04/79] netfilter: ct_extend: fix the wrong alloc_size kaber
2011-01-19 19:14 ` [PATCH 05/79] netfilter: nf_conntrack: define ct_*_info as needed kaber
2011-01-19 19:14 ` [PATCH 06/79] netfilter: nf_nat: don't use atomic bit operation kaber
2011-01-19 19:14 ` [PATCH 07/79] netfilter: ct_extend: define NF_CT_EXT_* as needed kaber
2011-01-19 19:14 ` [PATCH 08/79] netfilter: nf_nat: define nat_pptp_info " kaber
2011-01-19 19:14 ` [PATCH 09/79] netfilter: xt_CLASSIFY: add ARP support, allow CLASSIFY target on any table kaber
2011-01-19 19:14 ` [PATCH 10/79] netfilter: add __rcu annotations kaber
2011-01-19 19:14 ` [PATCH 11/79] netfilter: nf_ct_frag6_sysctl_table is static kaber
2011-01-19 19:14 ` [PATCH 12/79] netfilter: add __rcu annotations kaber
2011-01-19 19:14 ` [PATCH 13/79] netfilter: nf_nat_amanda: rename a variable kaber
2011-01-19 19:14 ` [PATCH 14/79] netfilter: rcu sparse cleanups kaber
2011-01-19 19:14 ` [PATCH 15/79] IPVS: Add persistence engine to connection entry kaber
2011-01-19 19:14 ` [PATCH 16/79] IPVS: Only match pe_data created by the same pe kaber
2011-01-19 19:14 ` [PATCH 17/79] IPVS: Make the cp argument to ip_vs_sync_conn() static kaber
2011-01-19 19:14 ` [PATCH 18/79] IPVS: Remove useless { } block from ip_vs_process_message() kaber
2011-01-19 19:40 ` Joe Perches
2011-01-25 2:10 ` Simon Horman
2011-01-25 5:16 ` Simon Horman
2011-01-19 19:14 ` [PATCH 19/79] IPVS: buffer argument to ip_vs_process_message() should not be const kaber
2011-01-19 19:14 ` [PATCH 20/79] ipvs: add static and read_mostly attributes kaber
2011-01-19 19:14 ` [PATCH 21/79] ipvs: remove shadow rt variable kaber
2011-01-19 19:14 ` [PATCH 22/79] ipvs: allow transmit of GRO aggregated skbs kaber
2011-01-19 19:14 ` [PATCH 23/79] netfilter: nf_conntrack: one less atomic op in nf_ct_expect_insert() kaber
2011-01-19 19:14 ` [PATCH 24/79] IPVS: Backup, Prepare for transferring firewall marks (fwmark) to the backup daemon kaber
2011-01-19 19:14 ` [PATCH 25/79] IPVS: Split ports[2] into src_port and dst_port kaber
2011-01-19 19:14 ` [PATCH 26/79] IPVS: skb defrag in L7 helpers kaber
2011-01-19 19:14 ` [PATCH 27/79] IPVS: Handle Scheduling errors kaber
2011-01-19 19:14 ` [PATCH 28/79] IPVS: Backup, Adding structs for new sync format kaber
2011-01-19 19:14 ` [PATCH 29/79] IPVS: Backup, Adding Version 1 receive capability kaber
2011-01-19 19:14 ` [PATCH 30/79] IPVS: Backup, Change sending to Version 1 format kaber
2011-01-19 19:14 ` [PATCH 31/79] IPVS: Backup, adding version 0 sending capabilities kaber
2011-01-19 19:14 ` [PATCH 32/79] netfilter: xtables: use guarded types kaber
2011-01-19 19:14 ` [PATCH 33/79] netfilter: fix compilation when conntrack is disabled but tproxy is enabled kaber
2011-01-19 19:14 ` [PATCH 34/79] IPVS: netns, add basic init per netns kaber
2011-01-19 19:14 ` [PATCH 35/79] IPVS: netns to services part 1 kaber
2011-01-19 19:14 ` [PATCH 36/79] IPVS: netns awarness to lblcr sheduler kaber
2011-01-19 19:14 ` [PATCH 37/79] IPVS: netns awarness to lblc sheduler kaber
2011-01-19 19:14 ` [PATCH 38/79] IPVS: netns, prepare protocol kaber
2011-01-19 19:14 ` [PATCH 39/79] IPVS: netns preparation for proto_tcp kaber
2011-01-19 19:14 ` [PATCH 40/79] IPVS: netns preparation for proto_udp kaber
2011-01-19 19:14 ` [PATCH 41/79] IPVS: netns preparation for proto_sctp kaber
2011-01-19 19:14 ` [PATCH 42/79] IPVS: netns preparation for proto_ah_esp kaber
2011-01-19 19:14 ` [PATCH 43/79] IPVS: netns, use ip_vs_proto_data as param kaber
2011-01-19 19:14 ` [PATCH 44/79] IPVS: netns, common protocol changes and use of appcnt kaber
2011-01-19 19:14 ` [PATCH 45/79] IPVS: netns awareness to ip_vs_app kaber
2011-01-19 19:14 ` [PATCH 46/79] IPVS: netns awareness to ip_vs_est kaber
2011-01-19 19:14 ` [PATCH 47/79] IPVS: netns awareness to ip_vs_sync kaber
2011-01-19 19:14 ` [PATCH 48/79] IPVS: netns, ip_vs_stats and its procfs kaber
2011-01-19 19:14 ` [PATCH 49/79] IPVS: netns, connection hash got net as param kaber
2011-01-19 19:14 ` [PATCH 50/79] IPVS: netns, ip_vs_ctl local vars moved to ipvs struct kaber
2011-01-19 19:14 ` [PATCH 51/79] IPVS: netns, defense work timer kaber
2011-01-19 19:14 ` [PATCH 52/79] IPVS: netns, trash handling kaber
2011-01-19 19:14 ` [PATCH 53/79] IPVS: netns, svc counters moved in ip_vs_ctl,c kaber
2011-01-19 19:14 ` [PATCH 54/79] IPVS: netns, misc init_net removal in core kaber
2011-01-19 19:14 ` [PATCH 55/79] IPVS: netns, final patch enabling network name space kaber
2011-01-19 19:14 ` [PATCH 56/79] netfilter: xt_comment: drop unneeded unsigned qualifier kaber
2011-01-19 19:14 ` [PATCH 57/79] netfilter: xt_conntrack: support matching on port ranges kaber
2011-01-19 19:14 ` [PATCH 58/79] netfilter: x_table: speedup compat operations kaber
2011-01-19 19:14 ` [PATCH 59/79] netfilter: ebt_ip6: allow matching on ipv6-icmp types/codes kaber
2011-01-19 19:15 ` [PATCH 60/79] netfilter: fix Kconfig dependencies kaber
2011-01-19 19:15 ` [PATCH 61/79] netfilter: nf_conntrack: use is_vmalloc_addr() kaber
2011-01-19 19:15 ` [PATCH 62/79] netfilter: audit target to record accepted/dropped packets kaber
2011-01-19 19:15 ` [PATCH 63/79] netfilter: create audit records for x_tables replaces kaber
2011-01-19 19:15 ` [PATCH 64/79] netfilter: xtables: add missing aliases for autoloading via iptables kaber
2011-01-19 19:15 ` [PATCH 65/79] audit: export symbol for use with xt_AUDIT kaber
2011-01-19 19:15 ` [PATCH 66/79] netfilter: xt_connlimit: use hotdrop jump mark kaber
2011-01-19 19:15 ` [PATCH 67/79] netfilter: xtables: use __uXX guarded types for userspace exports kaber
2011-01-19 19:15 ` [PATCH 68/79] netfilter: xtables: add missing header files to export list kaber
2011-01-19 19:15 ` [PATCH 69/79] netfilter: nf_nat: fix conversion to non-atomic bit ops kaber
2011-01-19 19:15 ` [PATCH 70/79] netfilter: nf_conntrack: remove an atomic bit operation kaber
2011-01-19 19:15 ` [PATCH 71/79] netfilter: Kconfig: NFQUEUE is useless without NETFILTER_NETLINK_QUEUE kaber
2011-01-19 19:15 ` kaber [this message]
2011-01-19 19:15 ` [PATCH 73/79] netfilter: nfnetlink_queue: do not free skb on error kaber
2011-01-19 19:15 ` [PATCH 74/79] netfilter: reduce NF_VERDICT_MASK to 0xff kaber
2011-01-19 19:15 ` [PATCH 75/79] netfilter: allow NFQUEUE bypass if no listener is available kaber
2011-01-19 19:15 ` [PATCH 76/79] netfilter: ipt_CLUSTERIP: remove "no conntrack!" kaber
2011-01-19 19:15 ` [PATCH 77/79] netfilter: nf_conntrack: nf_conntrack snmp helper kaber
2011-01-19 19:15 ` [PATCH 78/79] netfilter: nf_conntrack_tstamp: add flow-based timestamp extension kaber
2011-01-19 19:15 ` [PATCH 79/79] netfilter: nf_conntrack: fix lifetime display for disabled connections kaber
2011-01-19 21:55 ` [PATCH 00/79] netfilter: netfilter update David Miller
2011-01-20 0:50 ` David Miller
2011-01-20 0:59 ` Jan Engelhardt
2011-01-20 1:13 ` Patrick McHardy
2011-01-20 1:36 ` Jan Engelhardt
2011-01-20 7:49 ` Patrick McHardy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1295464519-21763-73-git-send-email-kaber@trash.net \
--to=kaber@trash.net \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.