mirror of
https://github.com/torvalds/linux.git
synced 2024-11-26 06:02:05 +00:00
netfilter: deprecate NF_STOP
NF_STOP is only used by br_netfilter these days, and it can be emulated with a combination of NF_STOLEN plus explicit call to the ->okfn() function as Florian suggests. To retain binary compatibility with userspace nf_queue application, we have to keep NF_STOP around, so libnetfilter_queue userspace userspace applications still work if they use NF_STOP for some exotic reason. Out of tree modules using NF_STOP would break, but we don't care about those. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
1610a73c41
commit
06fd3a392b
@ -13,7 +13,7 @@
|
||||
#define NF_STOLEN 2
|
||||
#define NF_QUEUE 3
|
||||
#define NF_REPEAT 4
|
||||
#define NF_STOP 5
|
||||
#define NF_STOP 5 /* Deprecated, for userspace nf_queue compatibility. */
|
||||
#define NF_MAX_VERDICT NF_STOP
|
||||
|
||||
/* we overload the higher bits for encoding auxiliary data such as the queue
|
||||
|
@ -845,8 +845,10 @@ static unsigned int ip_sabotage_in(void *priv,
|
||||
struct sk_buff *skb,
|
||||
const struct nf_hook_state *state)
|
||||
{
|
||||
if (skb->nf_bridge && !skb->nf_bridge->in_prerouting)
|
||||
return NF_STOP;
|
||||
if (skb->nf_bridge && !skb->nf_bridge->in_prerouting) {
|
||||
state->okfn(state->net, state->sk, skb);
|
||||
return NF_STOLEN;
|
||||
}
|
||||
|
||||
return NF_ACCEPT;
|
||||
}
|
||||
|
@ -333,7 +333,7 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state)
|
||||
entry = rcu_dereference(state->hook_entries);
|
||||
next_hook:
|
||||
verdict = nf_iterate(skb, state, &entry);
|
||||
if (verdict == NF_ACCEPT || verdict == NF_STOP) {
|
||||
if (verdict == NF_ACCEPT) {
|
||||
ret = 1;
|
||||
} else if ((verdict & NF_VERDICT_MASK) == NF_DROP) {
|
||||
kfree_skb(skb);
|
||||
|
Loading…
Reference in New Issue
Block a user