|
 |
df4535 |
From 3696c4af80496a0dd5a3637e4be11754e2cdc99e Mon Sep 17 00:00:00 2001
|
|
|
df4535 |
From: Phil Sutter <phil@nwl.cc>
|
|
|
df4535 |
Date: Wed, 4 May 2022 11:19:16 +0200
|
|
|
df4535 |
Subject: [PATCH] nft: Fix EPERM handling for extensions without rev 0
|
|
|
df4535 |
|
|
|
df4535 |
Treating revision 0 as compatible in EPERM case works fine as long as
|
|
|
df4535 |
there is a revision 0 of that extension defined in DSO. Fix the code for
|
|
|
df4535 |
others: Extend the EPERM handling to all revisions and keep the existing
|
|
|
df4535 |
warning for revision 0.
|
|
|
df4535 |
|
|
|
df4535 |
Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions")
|
|
|
df4535 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
df4535 |
(cherry picked from commit 8468fd4f7c85c21ab375402bc80d0188412b6cbf)
|
|
|
df4535 |
---
|
|
|
df4535 |
iptables/nft.c | 11 +++++++----
|
|
|
df4535 |
.../shell/testcases/iptables/0008-unprivileged_0 | 6 ++++++
|
|
|
df4535 |
2 files changed, 13 insertions(+), 4 deletions(-)
|
|
|
df4535 |
|
|
|
df4535 |
diff --git a/iptables/nft.c b/iptables/nft.c
|
|
|
df4535 |
index 9643abf2d0085..9839e8c683708 100644
|
|
|
df4535 |
--- a/iptables/nft.c
|
|
|
df4535 |
+++ b/iptables/nft.c
|
|
|
df4535 |
@@ -3110,15 +3110,18 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt)
|
|
|
df4535 |
err:
|
|
|
df4535 |
mnl_socket_close(nl);
|
|
|
df4535 |
|
|
|
df4535 |
- /* pretend revision 0 is valid -
|
|
|
df4535 |
+ /* ignore EPERM and errors for revision 0 -
|
|
|
df4535 |
* this is required for printing extension help texts as user, also
|
|
|
df4535 |
* helps error messaging on unavailable kernel extension */
|
|
|
df4535 |
- if (ret < 0 && rev == 0) {
|
|
|
df4535 |
- if (errno != EPERM)
|
|
|
df4535 |
+ if (ret < 0) {
|
|
|
df4535 |
+ if (errno == EPERM)
|
|
|
df4535 |
+ return 1;
|
|
|
df4535 |
+ if (rev == 0) {
|
|
|
df4535 |
fprintf(stderr,
|
|
|
df4535 |
"Warning: Extension %s revision 0 not supported, missing kernel module?\n",
|
|
|
df4535 |
name);
|
|
|
df4535 |
- return 1;
|
|
|
df4535 |
+ return 1;
|
|
|
df4535 |
+ }
|
|
|
df4535 |
}
|
|
|
df4535 |
|
|
|
df4535 |
return ret < 0 ? 0 : 1;
|
|
|
df4535 |
diff --git a/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0
|
|
|
df4535 |
index 43e3bc8721dbd..983531fef4720 100755
|
|
|
df4535 |
--- a/iptables/tests/shell/testcases/iptables/0008-unprivileged_0
|
|
|
df4535 |
+++ b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0
|
|
|
df4535 |
@@ -35,6 +35,12 @@ let "rc+=$?"
|
|
|
df4535 |
grep_or_rc "DNAT target options:" <<< "$out"
|
|
|
df4535 |
let "rc+=$?"
|
|
|
df4535 |
|
|
|
df4535 |
+# TEE has no revision 0
|
|
|
df4535 |
+out=$(run $XT_MULTI iptables -j TEE --help)
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+grep_or_rc "TEE target options:" <<< "$out"
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+
|
|
|
df4535 |
out=$(run $XT_MULTI iptables -p tcp -j DNAT --help)
|
|
|
df4535 |
let "rc+=$?"
|
|
|
df4535 |
grep_or_rc "tcp match options:" <<< "$out"
|
|
|
df4535 |
--
|
|
|
df4535 |
2.34.1
|
|
|
df4535 |
|