netfilter: bridge: convert br_netfilter to NF_DROP_REASON

errno is 0 because these hooks are called from prerouting and forward.
There is no socket that the errno would ever be propagated to.

Other netfilter modules (e.g. nf_nat, conntrack, ...) can be converted
in a similar way.

Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 033034d68f1f057349acdd2f127c427195be6b62..4c0c9f838f5c8dc3c480b6f67842149209e3b341 100644 (file)
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -486,11 +486,11 @@ static unsigned int br_nf_pre_routing(void *priv,
        struct brnf_net *brnet;
 
        if (unlikely(!pskb_may_pull(skb, len)))
-               return NF_DROP;
+               return NF_DROP_REASON(skb, SKB_DROP_REASON_PKT_TOO_SMALL, 0);
 
        p = br_port_get_rcu(state->in);
        if (p == NULL)
-               return NF_DROP;
+               return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0);
        br = p->br;
 
        brnet = net_generic(state->net, brnf_net_id);
@@ -501,7 +501,7 @@ static unsigned int br_nf_pre_routing(void *priv,
                        return NF_ACCEPT;
                if (!ipv6_mod_enabled()) {
                        pr_warn_once("Module ipv6 is disabled, so call_ip6tables is not supported.");
-                       return NF_DROP;
+                       return NF_DROP_REASON(skb, SKB_DROP_REASON_IPV6DISABLED, 0);
                }
 
                nf_bridge_pull_encap_header_rcsum(skb);
@@ -518,12 +518,12 @@ static unsigned int br_nf_pre_routing(void *priv,
        nf_bridge_pull_encap_header_rcsum(skb);
 
        if (br_validate_ipv4(state->net, skb))
-               return NF_DROP;
+               return NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0);
 
        if (!nf_bridge_alloc(skb))
-               return NF_DROP;
+               return NF_DROP_REASON(skb, SKB_DROP_REASON_NOMEM, 0);
        if (!setup_pre_routing(skb, state->net))
-               return NF_DROP;
+               return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0);
 
        nf_bridge = nf_bridge_info_get(skb);
        nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr;
@@ -590,15 +590,15 @@ static unsigned int br_nf_forward_ip(void *priv,
        /* Need exclusive nf_bridge_info since we might have multiple
         * different physoutdevs. */
        if (!nf_bridge_unshare(skb))
-               return NF_DROP;
+               return NF_DROP_REASON(skb, SKB_DROP_REASON_NOMEM, 0);
 
        nf_bridge = nf_bridge_info_get(skb);
        if (!nf_bridge)
-               return NF_DROP;
+               return NF_DROP_REASON(skb, SKB_DROP_REASON_NOMEM, 0);
 
        parent = bridge_parent(state->out);
        if (!parent)
-               return NF_DROP;
+               return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0);
 
        if (IS_IP(skb) || is_vlan_ip(skb, state->net) ||
            is_pppoe_ip(skb, state->net))
@@ -618,13 +618,13 @@ static unsigned int br_nf_forward_ip(void *priv,
 
        if (pf == NFPROTO_IPV4) {
                if (br_validate_ipv4(state->net, skb))
-                       return NF_DROP;
+                       return NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0);
                IPCB(skb)->frag_max_size = nf_bridge->frag_max_size;
        }
 
        if (pf == NFPROTO_IPV6) {
                if (br_validate_ipv6(state->net, skb))
-                       return NF_DROP;
+                       return NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0);
                IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size;
        }
 
@@ -666,7 +666,7 @@ static unsigned int br_nf_forward_arp(void *priv,
        }
 
        if (unlikely(!pskb_may_pull(skb, sizeof(struct arphdr))))
-               return NF_DROP;
+               return NF_DROP_REASON(skb, SKB_DROP_REASON_PKT_TOO_SMALL, 0);
 
        if (arp_hdr(skb)->ar_pln != 4) {
                if (is_vlan_arp(skb, state->net))
@@ -831,7 +831,7 @@ static unsigned int br_nf_post_routing(void *priv,
                return NF_ACCEPT;
 
        if (!realoutdev)
-               return NF_DROP;
+               return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0);
 
        if (IS_IP(skb) || is_vlan_ip(skb, state->net) ||
            is_pppoe_ip(skb, state->net))

diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c
index 550039dfc31a9c9db8d49cf20abb96985fbea708..2e24a743f91731cad6a8791e85af7f7aeadb8352 100644 (file)
--- a/net/bridge/br_netfilter_ipv6.c
+++ b/net/bridge/br_netfilter_ipv6.c
@@ -161,13 +161,13 @@ unsigned int br_nf_pre_routing_ipv6(void *priv,
        struct nf_bridge_info *nf_bridge;
 
        if (br_validate_ipv6(state->net, skb))
-               return NF_DROP;
+               return NF_DROP_REASON(skb, SKB_DROP_REASON_IP_INHDR, 0);
 
        nf_bridge = nf_bridge_alloc(skb);
        if (!nf_bridge)
-               return NF_DROP;
+               return NF_DROP_REASON(skb, SKB_DROP_REASON_NOMEM, 0);
        if (!setup_pre_routing(skb, state->net))
-               return NF_DROP;
+               return NF_DROP_REASON(skb, SKB_DROP_REASON_DEV_READY, 0);
 
        nf_bridge = nf_bridge_info_get(skb);
        nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr;