History

netfilter: nf_tables: report EOPNOTSUPP on unsupported flags/object type

EINVAL should be used for malformed netlink messages. New userspace utility and old kernels might easily result in EINVAL when exercising new set features, which is misleading.

Pablo Neira Ayuso committed 6 years ago

Commit d9583cd1 parent b135fc01 file · +2 −2Browse files

Unified · Split

net/netfilter/nf_tables_api.c+2−2
@@ -3963,7 +3963,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, · 3962 unmodified lines
39633963 NFT_SET_INTERVAL | NFT_SET_TIMEOUT |
39643964 NFT_SET_MAP | NFT_SET_EVAL |
39653965 NFT_SET_OBJECT))
3966− return -EINVAL;
3966+ return -EOPNOTSUPP;
39673967 /* Only one of these operations is supported */
39683968 if ((flags & (NFT_SET_MAP | NFT_SET_OBJECT)) ==
39693969 (NFT_SET_MAP | NFT_SET_OBJECT))
@@ -4001,7 +4001,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, · 31 unmodified lines
40014001 objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
40024002 if (objtype == NFT_OBJECT_UNSPEC ||
40034003 objtype > NFT_OBJECT_MAX)
4004− return -EINVAL;
4004+ return -EOPNOTSUPP;
40054005 } else if (flags & NFT_SET_OBJECT)
40064006 return -EINVAL;
40074007 else