netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported

[ Upstream commit 0d7c83463fdf7841350f37960a7abadd3e650b41 ]

Instead of EINVAL which should be used for malformed netlink messages.

Fixes: eb31628e37a0 ("netfilter: nf_tables: Add support for IPv6 NAT")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index ed548d06b6dda9a98888bb83f2baa6b45c965c15..a18cceecef88e3789bc1cd3613cdb1f2eac17572 100644 (file)
--- a/net/netfilter/nft_nat.c
+++ b/net/netfilter/nft_nat.c
@@ -135,7 +135,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
                priv->type = NF_NAT_MANIP_DST;
                break;
        default:
-               return -EINVAL;
+               return -EOPNOTSUPP;
        }
 
        if (tb[NFTA_NAT_FAMILY] == NULL)
@@ -202,7 +202,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
        if (tb[NFTA_NAT_FLAGS]) {
                priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS]));
                if (priv->flags & ~NF_NAT_RANGE_MASK)
-                       return -EINVAL;
+                       return -EOPNOTSUPP;
        }
 
        return nf_ct_netns_get(ctx->net, family);