Handle >0 return value from outfn in __nf_queue(). This value
is not passed up the stack but intercepted by nf_queue(), which
returns 0 to upper layers.
Also add support for GSO skb. If __nf_queue() returns >0 to
indicate fail-open, we call okfn() immediately.
Signed-off-by: Krishna Kumar <krkumar2@xxxxxxxxxx>
Signed-off-by: Vivek Kashyap <vivk@xxxxxxxxxx>
Signed-off-by: Sridhar Samudrala <samudrala@xxxxxxxxxx>
---
net/netfilter/nf_queue.c | 33 +++++++++++++++++++++++++++------
1 file changed, 27 insertions(+), 6 deletions(-)
diff -ruNp org/net/netfilter/nf_queue.c new/net/netfilter/nf_queue.c
--- org/net/netfilter/nf_queue.c 2012-05-08 13:02:18.163816400 +0530
+++ new/net/netfilter/nf_queue.c 2012-05-08 15:08:11.028555335 +0530
@@ -189,7 +189,7 @@ static int __nf_queue(struct sk_buff *sk
rcu_read_unlock();
- if (status < 0) {
+ if (status) {
nf_queue_entry_release_refs(entry);
goto err;
}
@@ -236,9 +236,18 @@ int nf_queue(struct sk_buff *skb,
int err = -EINVAL;
unsigned int queued;
- if (!skb_is_gso(skb))
- return __nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
+ if (!skb_is_gso(skb)) {
+ err = __nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
queuenum);
+ if (err > 0) {
+ /* Queue failed due to queue-full and handler
+ * returned >0 indicating fail-open - temporarily
+ * accept packets.
+ */
+ err = okfn(skb);
+ }
+ return err;
+ }
switch (pf) {
case NFPROTO_IPV4:
@@ -268,14 +277,26 @@ int nf_queue(struct sk_buff *skb,
err = __nf_queue(segs, elem, pf, hook, indev,
outdev, okfn, queuenum);
}
- if (err == 0)
+
+ if (err == 0) {
queued++;
- else
+ } else if (err > 0) {
+ /* Queue failed due to queue-full and handler
+ * returned >0 indicating fail-open - accept
+ * this and remaining segments.
+ */
+ okfn(segs);
+ } else {
+ /* Queue failed due to queue-full and handler
+ * returned <0 - free this and remaining skb
+ * segments.
+ */
kfree_skb(segs);
+ }
segs = nskb;
} while (segs);
- if (queued) {
+ if (queued || err > 0) {
kfree_skb(skb);
return 0;
}
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
