diff options
| author |   Patrick McHardy <kaber@trash.net> | 2013-04-05 06:41:11 +0000 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2013-04-08 12:34:01 +0200 |
| commit | 58e35d1471287c59b9749fb82f04c628c36b9994 (patch) | |
| tree | a09f82319c6a2599f8c0ab9f94913aa4faf58448 /net/ipv4/netfilter.c | |
| parent | netfilter: ipv4: propagate routing errors from ip_route_me_harder() (diff) | |
| download | wireguard-linux-58e35d1471287c59b9749fb82f04c628c36b9994.tar.xz wireguard-linux-58e35d1471287c59b9749fb82f04c628c36b9994.zip | |
netfilter: ipv6: propagate routing errors from ip6_route_me_harder()
Propagate routing errors from ip_route_me_harder() when dropping a packet
using NF_DROP_ERR(). This makes userspace get the proper error instead of
EPERM for everything.
# ip -6 r a unreachable default table 100
# ip -6 ru add fwmark 0x1 lookup 100
# ip6tables -t mangle -A OUTPUT -d 2001:4860:4860::8888 -j MARK --set-mark 0x1
Old behaviour:
PING 2001:4860:4860::8888(2001:4860:4860::8888) 56 data bytes
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
New behaviour:
PING 2001:4860:4860::8888(2001:4860:4860::8888) 56 data bytes
ping: sendmsg: Network is unreachable
ping: sendmsg: Network is unreachable
ping: sendmsg: Network is unreachable
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv4/netfilter.c')
0 files changed, 0 insertions, 0 deletions