Do not translate the EACCES error from pf(4) to EHOSTUNREACH anymore.

It also translated a documented send(2) EACCES case erroneously.
This was too much magic and always prone to errors.
from Jan Klemkow; man page jmc@; OK claudio@

5 files changed, 11 insertions, 17 deletions

diff --git a/lib/libc/sys/send.2 b/lib/libc/sys/send.2
index 38b78fce075..1e83e9f0b83 100644
--- a/lib/libc/sys/send.2
+++ b/lib/libc/sys/send.2
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: send.2,v 1.32 2017/10/05 12:30:16 bluhm Exp $
+.\"	$OpenBSD: send.2,v 1.33 2018/11/10 18:40:34 bluhm Exp $
 .\"	$NetBSD: send.2,v 1.6 1996/01/15 01:17:18 thorpej Exp $
 .\"
 .\" Copyright (c) 1983, 1991, 1993
@@ -30,7 +30,7 @@
 .\"
 .\"     @(#)send.2	8.2 (Berkeley) 2/21/94
 .\"
-.Dd $Mdocdate: October 5 2017 $
+.Dd $Mdocdate: November 10 2018 $
 .Dt SEND 2
 .Os
 .Sh NAME
@@ -162,10 +162,12 @@ The output queue for a network interface was full.
 This generally indicates that the interface has stopped sending,
 but may be caused by transient congestion.
 .It Bq Er EACCES
-The
+The connection was blocked by
+.Xr pf 4 ,
+or
 .Dv SO_BROADCAST
-option is not set on the socket, and a broadcast address
-was given as the destination.
+is not set on the socket
+and a broadcast address was given as the destination.
 .It Bq Er EHOSTUNREACH
 The destination address specified an unreachable host.
 .It Bq Er EINVAL
diff --git a/sys/netinet/ip_divert.c b/sys/netinet/ip_divert.c
index ec6b0dea5b0..3b7cb84a511 100644
--- a/sys/netinet/ip_divert.c
+++ b/sys/netinet/ip_divert.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ip_divert.c,v 1.59 2018/10/04 17:33:41 bluhm Exp $ */
+/*      $OpenBSD: ip_divert.c,v 1.60 2018/11/10 18:40:34 bluhm Exp $ */
 
 /*
  * Copyright (c) 2009 Michele Marchetto <michele@openbsd.org>
@@ -157,8 +157,6 @@ divert_output(struct inpcb *inp, struct mbuf *m, struct mbuf *nam,
 
 		error = ip_output(m, NULL, &inp->inp_route,
 		    IP_ALLOWBROADCAST | IP_RAWOUTPUT, NULL, NULL, 0);
-		if (error == EACCES)	/* translate pf(4) error for userland */
-			error = EHOSTUNREACH;
 	}
 
 	divstat_inc(divs_opackets);
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index d3d79872ed3..cfa54f2b5fc 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raw_ip.c,v 1.114 2018/10/04 17:33:41 bluhm Exp $	*/
+/*	$OpenBSD: raw_ip.c,v 1.115 2018/11/10 18:40:34 bluhm Exp $	*/
 /*	$NetBSD: raw_ip.c,v 1.25 1996/02/18 18:58:33 christos Exp $	*/
 
 /*
@@ -292,8 +292,6 @@ rip_output(struct mbuf *m, struct socket *so, struct sockaddr *dstaddr,
 
 	error = ip_output(m, inp->inp_options, &inp->inp_route, flags,
 	    inp->inp_moptions, inp, 0);
-	if (error == EACCES)	/* translate pf(4) error for userland */
-		error = EHOSTUNREACH;
 	return (error);
 }
 
diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c
index ea25d06c7e9..27a8739081c 100644
--- a/sys/netinet/tcp_output.c
+++ b/sys/netinet/tcp_output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tcp_output.c,v 1.127 2018/11/09 14:14:31 claudio Exp $	*/
+/*	$OpenBSD: tcp_output.c,v 1.128 2018/11/10 18:40:34 bluhm Exp $	*/
 /*	$NetBSD: tcp_output.c,v 1.16 1997/06/03 16:17:09 kml Exp $	*/
 
 /*
@@ -1084,8 +1084,6 @@ out:
 			tcp_mtudisc(tp->t_inpcb, -1);
 			return (0);
 		}
-		if (error == EACCES)	/* translate pf(4) error for userland */
-			error = EHOSTUNREACH;
 		if ((error == EHOSTUNREACH || error == ENETDOWN) &&
 		    TCPS_HAVERCVDSYN(tp->t_state)) {
 			tp->t_softerror = error;
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index b2f5a6732d7..f224f35787f 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: udp_usrreq.c,v 1.253 2018/10/04 17:33:41 bluhm Exp $	*/
+/*	$OpenBSD: udp_usrreq.c,v 1.254 2018/11/10 18:40:34 bluhm Exp $	*/
 /*	$NetBSD: udp_usrreq.c,v 1.28 1996/03/16 23:54:03 christos Exp $	*/
 
 /*
@@ -1004,8 +1004,6 @@ udp_output(struct inpcb *inp, struct mbuf *m, struct mbuf *addr,
 	error = ip_output(m, inp->inp_options, &inp->inp_route,
 	    (inp->inp_socket->so_options & SO_BROADCAST), inp->inp_moptions,
 	    inp, ipsecflowinfo);
-	if (error == EACCES)	/* translate pf(4) error for userland */
-		error = EHOSTUNREACH;
 
 bail:
 	m_freem(control);