Commit 0d7c8346 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported 



Instead of EINVAL which should be used for malformed netlink messages.

Fixes: eb31628e ("netfilter: nf_tables: Add support for IPv6 NAT")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent fdb9c405

net/netfilter/nft_nat.c

+2 −2
Original line number Diff line number Diff line
@@ -129,7 +129,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 
		priv->type = NF_NAT_MANIP_DST;

		break;

	default:

		return -EINVAL;

		return -EOPNOTSUPP;

	}



	if (tb[NFTA_NAT_FAMILY] == NULL)
@@ -196,7 +196,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 
	if (tb[NFTA_NAT_FLAGS]) {

		priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));

		if (priv->flags & ~NF_NAT_RANGE_MASK)

			return -EINVAL;

			return -EOPNOTSUPP;

	}



	return nf_ct_netns_get(ctx->net, family);

CRA Git | Maintained and supported by SUSTech CRA and CCSE