netfilter: nf_tables: report EOPNOTSUPP on unsupported flags/object type (d9583cdf) · Commits · 戴 / test

EINVAL should be used for malformed netlink messages. New userspace utility and old kernels might easily result in EINVAL when exercising new set features, which is misleading. Fixes: ("netfilter: nf_tables: add stateful object reference to set elements") Signed-off-by:

Pablo Neira Ayuso <pablo@netfilter.org>

net/netfilter/nf_tables_api.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -3963,7 +3963,7 @@ static int nf_tables_newset(struct net net, struct sock nlsk,
		NFT_SET_INTERVAL \| NFT_SET_TIMEOUT \|
		NFT_SET_MAP \| NFT_SET_EVAL \|
		NFT_SET_OBJECT))
		return -EINVAL;
		return -EOPNOTSUPP;
		/* Only one of these operations is supported */
		if ((flags & (NFT_SET_MAP \| NFT_SET_OBJECT)) ==
		(NFT_SET_MAP \| NFT_SET_OBJECT))
		@@ -4001,7 +4001,7 @@ static int nf_tables_newset(struct net net, struct sock nlsk,
		objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
		if (objtype == NFT_OBJECT_UNSPEC \|\|
		objtype > NFT_OBJECT_MAX)
		return -EINVAL;
		return -EOPNOTSUPP;
		} else if (flags & NFT_SET_OBJECT)
		return -EINVAL;
		else

Admin message