netfilter: allow hooks to pass error code back up the stack

[net-next-2.6.git] / net / netfilter / core.c

diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 85dabb86be6f45dda9b5686466ce487c2b848a5c..32fcbe290c047802942b5d9838489a2193b622b2 100644 (file)
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -173,9 +173,11 @@ next_hook:
                             outdev, &elem, okfn, hook_thresh);
        if (verdict == NF_ACCEPT || verdict == NF_STOP) {
                ret = 1;
-       } else if (verdict == NF_DROP) {
+       } else if ((verdict & NF_VERDICT_MASK) == NF_DROP) {
                kfree_skb(skb);
-               ret = -EPERM;
+               ret = -(verdict >> NF_VERDICT_BITS);
+               if (ret == 0)
+                       ret = -EPERM;
        } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
                if (!nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
                              verdict >> NF_VERDICT_BITS))