• Florian Westphal's avatar
    netfilter: reduce NF_VERDICT_MASK to 0xff · f615df76
    Florian Westphal authored
    NF_VERDICT_MASK is currently 0xffff. This is because the upper
    16 bits are used to store errno (for NF_DROP) or the queue number
    (NF_QUEUE verdict).
    
    As there are up to 0xffff different queues available, there is no more
    room to store additional flags.
    
    At the moment there are only 6 different verdicts, i.e. we can reduce
    NF_VERDICT_MASK to 0xff to allow storing additional flags in the 0xff00 space.
    
    NF_VERDICT_BITS would then be reduced to 8, but because the value is
    exported to userspace, this might cause breakage; e.g.:
    
    e.g. 'queuenr = (1 << NF_VERDICT_BITS) | NF_QUEUE'  would now break.
    
    Thus, remove NF_VERDICT_BITS usage in the kernel and move the old value
    to the 'userspace compat' section.
    Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
    Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
    f615df76
core.c 6.89 KB