• Patrick McHardy's avatar
    netfilter: ipv4: propagate routing errors from ip_route_me_harder() · c9e1673a
    Patrick McHardy authored
    Propagate routing errors from ip_route_me_harder() when dropping a packet
    using NF_DROP_ERR(). This makes userspace get the proper error instead of
    EPERM for everything.
    
    Example:
    
    # ip r a unreachable default table 100
    # ip ru add fwmark 0x1 lookup 100
    # iptables -t mangle -A OUTPUT -d 8.8.8.8 -j MARK --set-mark 0x1
    
    Current behaviour:
    
    PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
    ping: sendmsg: Operation not permitted
    ping: sendmsg: Operation not permitted
    ping: sendmsg: Operation not permitted
    
    New behaviour:
    
    PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
    ping: sendmsg: Network is unreachable
    ping: sendmsg: Network is unreachable
    ping: sendmsg: Network is unreachable
    ping: sendmsg: Network is unreachable
    Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    c9e1673a
netfilter.c 5.2 KB