tree 3da5f7df2b3015c3f8a899d50cf9fd4ffd5b38ff
parent 4538b02484e4c2d0c016ca190c5219fd97f932fb
author Pablo Neira Ayuso <pablo@netfilter.org> 1718240518 +0200
committer Vegard Nossum <vegard.nossum@oracle.com> 1721068223 +0000

netfilter: nft_dynset: report EOPNOTSUPP on missing set feature

commit 95cd4bca7b1f4a25810f3ddfc5e767fb46931789 upstream.

If userspace requests a feature which is not available the original set
definition, then bail out with EOPNOTSUPP. If userspace sends
unsupported dynset flags (new feature not supported by this kernel),
then report EOPNOTSUPP to userspace. EINVAL should be only used to
report malformed netlink messages from userspace.

Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit c5c4746c8cd6d049dcbf39c811172c917ea6fb6e)
[Vegard: fix conflicts due to missing commits
 8e1102d5a1596dca10f51e3de800809944f8816d ("netfilter: nf_tables: support
 timeouts larger than 23 days") and b13468dc577498002cf4e62978359ff97ffcd187
 ("netfilter: nft_dynset: fix timeout updates on 32bit").]
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>