Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c5c4746c authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Greg Kroah-Hartman
Browse files

netfilter: nft_dynset: report EOPNOTSUPP on missing set feature 



commit 95cd4bca7b1f4a25810f3ddfc5e767fb46931789 upstream.

If userspace requests a feature which is not available the original set
definition, then bail out with EOPNOTSUPP. If userspace sends
unsupported dynset flags (new feature not supported by this kernel),
then report EOPNOTSUPP to userspace. EINVAL should be only used to
report malformed netlink messages from userspace.

Fixes: 22fe54d5 ("netfilter: nf_tables: add support for dynamic set updates")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 28a97c43

net/netfilter/nft_dynset.c

+3 −3
Original line number Diff line number Diff line
@@ -133,7 +133,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx, 
		u32 flags = ntohl(nla_get_be32(tb[NFTA_DYNSET_FLAGS]));



		if (flags & ~NFT_DYNSET_F_INV)

			return -EINVAL;

			return -EOPNOTSUPP;

		if (flags & NFT_DYNSET_F_INV)

			priv->invert = true;

	}
@@ -168,7 +168,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx, 
	timeout = 0;

	if (tb[NFTA_DYNSET_TIMEOUT] != NULL) {

		if (!(set->flags & NFT_SET_TIMEOUT))

			return -EINVAL;

			return -EOPNOTSUPP;



		err = nf_msecs_to_jiffies64(tb[NFTA_DYNSET_TIMEOUT], &timeout);

		if (err)
@@ -182,7 +182,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx, 


	if (tb[NFTA_DYNSET_SREG_DATA] != NULL) {

		if (!(set->flags & NFT_SET_MAP))

			return -EINVAL;

			return -EOPNOTSUPP;

		if (set->dtype == NFT_DATA_VERDICT)

			return -EOPNOTSUPP;