aboutsummaryrefslogtreecommitdiffstats
path: root/net/netfilter/core.c
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2016-11-03 10:56:30 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2016-11-03 11:52:57 +0100
commitc63cbc4604199af6627633f2bb3847a8951f48e5 (patch)
tree53ed5af31a234c4c41028570e2561e9f4079609c /net/netfilter/core.c
parentnetfilter: nf_tables: use hook state from xt_action_param structure (diff)
downloadlinux-dev-c63cbc4604199af6627633f2bb3847a8951f48e5.tar.xz
linux-dev-c63cbc4604199af6627633f2bb3847a8951f48e5.zip
netfilter: use switch() to handle verdict cases from nf_hook_slow()
Use switch() for verdict handling and add explicit handling for NF_STOLEN and other non-conventional verdicts. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/core.c')
-rw-r--r--net/netfilter/core.c18
1 files changed, 14 insertions, 4 deletions
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 14f97b624f98..64623374bc5f 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -328,22 +328,32 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state)
{
struct nf_hook_entry *entry;
unsigned int verdict;
- int ret = 0;
+ int ret;
entry = rcu_dereference(state->hook_entries);
next_hook:
verdict = nf_iterate(skb, state, &entry);
- if (verdict == NF_ACCEPT) {
+ switch (verdict & NF_VERDICT_MASK) {
+ case NF_ACCEPT:
ret = 1;
- } else if ((verdict & NF_VERDICT_MASK) == NF_DROP) {
+ break;
+ case NF_DROP:
kfree_skb(skb);
ret = NF_DROP_GETERR(verdict);
if (ret == 0)
ret = -EPERM;
- } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
+ break;
+ case NF_QUEUE:
ret = nf_queue(skb, state, &entry, verdict);
if (ret == 1 && entry)
goto next_hook;
+ /* Fall through. */
+ default:
+ /* Implicit handling for NF_STOLEN, as well as any other non
+ * conventional verdicts.
+ */
+ ret = 0;
+ break;
}
return ret;
}