History

netfilter: nf_tables: report EOPNOTSUPP on unsupported flags/object type

EINVAL should be used for malformed netlink messages. New userspace utility and old kernels might easily result in EINVAL when exercising new set features, which is misleading.

Pablo Neira Ayuso committed 6 years ago

Commit d9583cd1 parent b135fc01 file · +2 −2Browse files

Unified · Split

net/netfilter/nf_tables_api.c+2−2
@@ -3963,7 +3963,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, · 3962 unmodified lines
3963 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |3963 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
3964 NFT_SET_MAP | NFT_SET_EVAL |3964 NFT_SET_MAP | NFT_SET_EVAL |
3965 NFT_SET_OBJECT))3965 NFT_SET_OBJECT))
3966 return -EINVAL;3966 return -EOPNOTSUPP;
3967 /* Only one of these operations is supported */3967 /* Only one of these operations is supported */
3968 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==3968 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
3969 (NFT_SET_MAP | NFT_SET_OBJECT))3969 (NFT_SET_MAP | NFT_SET_OBJECT))
@@ -4001,7 +4001,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, · 31 unmodified lines
4001 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));4001 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
4002 if (objtype == NFT_OBJECT_UNSPEC ||4002 if (objtype == NFT_OBJECT_UNSPEC ||
4003 objtype > NFT_OBJECT_MAX)4003 objtype > NFT_OBJECT_MAX)
4004 return -EINVAL;4004 return -EOPNOTSUPP;
4005 } else if (flags & NFT_SET_OBJECT)4005 } else if (flags & NFT_SET_OBJECT)
4006 return -EINVAL;4006 return -EINVAL;
4007 else4007 else