Commit 06fd3a39 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: deprecate NF_STOP 



NF_STOP is only used by br_netfilter these days, and it can be emulated
with a combination of NF_STOLEN plus explicit call to the ->okfn()
function as Florian suggests.

To retain binary compatibility with userspace nf_queue application, we
have to keep NF_STOP around, so libnetfilter_queue userspace userspace
applications still work if they use NF_STOP for some exotic reason.

Out of tree modules using NF_STOP would break, but we don't care about
those.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 1610a73c

include/uapi/linux/netfilter.h

+1 −1
Original line number Diff line number Diff line
@@ -13,7 +13,7 @@ 
#define NF_STOLEN 2

#define NF_QUEUE 3

#define NF_REPEAT 4

#define NF_STOP 5

#define NF_STOP 5	/* Deprecated, for userspace nf_queue compatibility. */

#define NF_MAX_VERDICT NF_STOP



/* we overload the higher bits for encoding auxiliary data such as the queue

net/bridge/br_netfilter_hooks.c

+4 −2
Original line number Diff line number Diff line
@@ -845,8 +845,10 @@ static unsigned int ip_sabotage_in(void *priv, 
				   struct sk_buff *skb,

				   const struct nf_hook_state *state)

{

	if (skb->nf_bridge && !skb->nf_bridge->in_prerouting)

		return NF_STOP;

	if (skb->nf_bridge && !skb->nf_bridge->in_prerouting) {

		state->okfn(state->net, state->sk, skb);

		return NF_STOLEN;

	}



	return NF_ACCEPT;

}

net/netfilter/core.c

+1 −1
Original line number Diff line number Diff line
@@ -333,7 +333,7 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state) 
	entry = rcu_dereference(state->hook_entries);

next_hook:

	verdict = nf_iterate(skb, state, &entry);

	if (verdict == NF_ACCEPT || verdict == NF_STOP) {

	if (verdict == NF_ACCEPT) {

		ret = 1;

	} else if ((verdict & NF_VERDICT_MASK) == NF_DROP) {

		kfree_skb(skb);

CRA Git | Maintained and supported by SUSTech CRA and CCSE