tree 9d1e3ba2f9f85469583c0af71dc528329a3425fe
parent 749f6f6843115b424680f1aada3c0dd613ad807c
author Pablo Neira Ayuso <pablo@netfilter.org> 1584843718 +0100
committer Pablo Neira Ayuso <pablo@netfilter.org> 1585076337 +0100

netfilter: nf_tables: Allow set back-ends to report partial overlaps on insertion

Currently, the -EEXIST return code of ->insert() callbacks is ambiguous: it
might indicate that a given element (including intervals) already exists as
such, or that the new element would clash with existing ones.

If identical elements already exist, the front-end is ignoring this without
returning error, in case NLM_F_EXCL is not set. However, if the new element
can't be inserted due an overlap, we should report this to the user.

To this purpose, allow set back-ends to return -ENOTEMPTY on collision with
existing elements, translate that to -EEXIST, and return that to userspace,
no matter if NLM_F_EXCL was set.

Reported-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>