netfilter: nf_tables: report EEXIST on overlaps
authorPablo Neira Ayuso <pablo@netfilter.org>
Sun, 2 Aug 2020 01:05:25 +0000 (03:05 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 3 Sep 2020 09:29:22 +0000 (11:29 +0200)
commit8ceddd70a6821601cbcb0486e1c337b7ef32cf2d
treefbe384a9e0313f1443d2f9b8040f12bbc119dea0
parent71e86271b49bb8e2ee5a74a6115746b03402d9d7
netfilter: nf_tables: report EEXIST on overlaps

[ Upstream commit 77a92189ecfd061616ad531d386639aab7baaad9 ]

Replace EBUSY by EEXIST in the following cases:

- If the user adds a chain with a different configuration such as different
  type, hook and priority.

- If the user adds a non-base chain that clashes with an existing basechain.

- If the user adds a { key : value } mapping element and the key exists
  but the value differs.

- If the device already belongs to an existing flowtable.

User describe that this error reporting is confusing:

- https://bugzilla.netfilter.org/show_bug.cgi?id=1176
- https://bugzilla.netfilter.org/show_bug.cgi?id=1413

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/netfilter/nf_tables_api.c