| commit | c9e1673a0accf086dfce9b501d8bcb4ec6bbc1e9 | |
| author | Patrick McHardy <kaber@trash.net> | |
| Fri, 5 Apr 2013 06:41:10 +0000 (5 06:41 +0000) | ||
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | |
| Mon, 8 Apr 2013 10:34:00 +0000 (8 12:34 +0200) | ||
| tree | 7a7b6de83f82c9bbad878c3ead23dd2ad4b59c32 | treesnapshot (tar.gz zip) |
| parent | 6b0ee8c036ecb3ac92e18e6ca0dca7bff88beaf0 | commitdiff |
netfilter: ipv4: propagate routing errors from ip_route_me_harder()
Propagate routing errors from ip_route_me_harder() when dropping a packet
using NF_DROP_ERR(). This makes userspace get the proper error instead of
EPERM for everything.
Example:
# ip r a unreachable default table 100
# ip ru add fwmark 0x1 lookup 100
# iptables -t mangle -A OUTPUT -d 8.8.8.8 -j MARK --set-mark 0x1
Current behaviour:
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
New behaviour:
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
ping: sendmsg: Network is unreachable
ping: sendmsg: Network is unreachable
ping: sendmsg: Network is unreachable
ping: sendmsg: Network is unreachable
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Propagate routing errors from ip_route_me_harder() when dropping a packet
using NF_DROP_ERR(). This makes userspace get the proper error instead of
EPERM for everything.
Example:
# ip r a unreachable default table 100
# ip ru add fwmark 0x1 lookup 100
# iptables -t mangle -A OUTPUT -d 8.8.8.8 -j MARK --set-mark 0x1
Current behaviour:
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
New behaviour:
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
ping: sendmsg: Network is unreachable
ping: sendmsg: Network is unreachable
ping: sendmsg: Network is unreachable
ping: sendmsg: Network is unreachable
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| net/ipv4/netfilter.c | diffblobblamehistory | |
| net/ipv4/netfilter/iptable_mangle.c | diffblobblamehistory | |
| net/ipv4/netfilter/iptable_nat.c | diffblobblamehistory |