1. 08 Apr, 2013 3 commits
    • Patrick McHardy's avatar
      netfilter: nat: propagate errors from xfrm_me_harder() · aaa795ad
      Patrick McHardy authored
      Propagate errors from ip_xfrm_me_harder() instead of returning EPERM in
      all cases.
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      aaa795ad
    • Patrick McHardy's avatar
      netfilter: ipv6: propagate routing errors from ip6_route_me_harder() · 58e35d14
      Patrick McHardy authored
      Propagate routing errors from ip_route_me_harder() when dropping a packet
      using NF_DROP_ERR(). This makes userspace get the proper error instead of
      EPERM for everything.
      
      # ip -6 r a unreachable default table 100
      # ip -6 ru add fwmark 0x1 lookup 100
      # ip6tables -t mangle -A OUTPUT -d 2001:4860:4860::8888 -j MARK --set-mark 0x1
      
      Old behaviour:
      
      PING 2001:4860:4860::8888(2001:4860:4860::8888) 56 data bytes
      ping: sendmsg: Operation not permitted
      ping: sendmsg: Operation not permitted
      ping: sendmsg: Operation not permitted
      
      New behaviour:
      
      PING 2001:4860:4860::8888(2001:4860:4860::8888) 56 data bytes
      ping: sendmsg: Network is unreachable
      ping: sendmsg: Network is unreachable
      ping: sendmsg: Network is unreachable
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      58e35d14
    • Patrick McHardy's avatar
      netfilter: ipv4: propagate routing errors from ip_route_me_harder() · c9e1673a
      Patrick McHardy authored
      Propagate routing errors from ip_route_me_harder() when dropping a packet
      using NF_DROP_ERR(). This makes userspace get the proper error instead of
      EPERM for everything.
      
      Example:
      
      # ip r a unreachable default table 100
      # ip ru add fwmark 0x1 lookup 100
      # iptables -t mangle -A OUTPUT -d 8.8.8.8 -j MARK --set-mark 0x1
      
      Current behaviour:
      
      PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
      ping: sendmsg: Operation not permitted
      ping: sendmsg: Operation not permitted
      ping: sendmsg: Operation not permitted
      
      New behaviour:
      
      PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
      ping: sendmsg: Network is unreachable
      ping: sendmsg: Network is unreachable
      ping: sendmsg: Network is unreachable
      ping: sendmsg: Network is unreachable
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      c9e1673a
  2. 07 Apr, 2013 37 commits