Florian Westphal e0d4593140 netfilter: make nftables drops visible in net dropmonitor
net_dropmonitor blames core.c:nf_hook_slow.
Add NF_DROP_REASON() helper and use it in nft_do_chain().

The helper releases the skb, so exact drop location becomes
available. Calling code will observe the NF_STOLEN verdict
instead.

Adjust nf_hook_slow so we can embed an erro value wih
NF_STOLEN verdicts, just like we do for NF_DROP.

After this, drop in nftables can be pinpointed to a drop due
to a rule or the chain policy.

Signed-off-by: Florian Westphal <fw@strlen.de>
2023-10-18 10:26:43 +02:00
..
2023-10-01 19:09:54 +01:00
2023-05-31 13:06:57 +02:00
2023-08-29 17:39:15 -07:00
2023-06-24 15:41:46 -07:00
2023-10-01 19:09:54 +01:00
2023-06-28 16:43:10 -07:00
2023-10-01 19:09:54 +01:00
2023-10-11 10:39:01 +01:00