|
 |
aca4c4 |
From f70e667bbc14c1dbf96b8732704aea294e4dcaa7 Mon Sep 17 00:00:00 2001
|
|
|
aca4c4 |
From: Phil Sutter <phil@nwl.cc>
|
|
|
aca4c4 |
Date: Thu, 30 Jun 2022 18:04:39 +0200
|
|
|
aca4c4 |
Subject: [PATCH] libxtables: Fix unsupported extension warning corner case
|
|
|
aca4c4 |
|
|
|
aca4c4 |
Some extensions are not supported in revision 0 by user space anymore,
|
|
|
aca4c4 |
for those the warning in xtables_compatible_revision() does not print as
|
|
|
aca4c4 |
no revision 0 is tried.
|
|
|
aca4c4 |
|
|
|
aca4c4 |
To fix this, one has to track if none of the user space supported
|
|
|
aca4c4 |
revisions were accepted by the kernel. Therefore add respective logic to
|
|
|
aca4c4 |
xtables_find_{target,match}().
|
|
|
aca4c4 |
|
|
|
aca4c4 |
Note that this does not lead to duplicated warnings for unsupported
|
|
|
aca4c4 |
extensions that have a revision 0 because xtables_compatible_revision()
|
|
|
aca4c4 |
returns true for them to allow for extension's help output.
|
|
|
aca4c4 |
|
|
|
aca4c4 |
For the record, these ip6tables extensions are affected: set/SET,
|
|
|
aca4c4 |
socket, tos/TOS, TPROXY and SNAT. In addition to that, TEE is affected
|
|
|
aca4c4 |
for both families.
|
|
|
aca4c4 |
|
|
|
aca4c4 |
Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions")
|
|
|
aca4c4 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
aca4c4 |
(cherry picked from commit 552c4a2f9e5706fef5f7abb27d1492a78bbb2a37)
|
|
|
aca4c4 |
---
|
|
|
aca4c4 |
libxtables/xtables.c | 14 ++++++++++++++
|
|
|
aca4c4 |
1 file changed, 14 insertions(+)
|
|
|
aca4c4 |
|
|
|
aca4c4 |
diff --git a/libxtables/xtables.c b/libxtables/xtables.c
|
|
|
aca4c4 |
index a5c8d7e2c17ef..89547fb3ab947 100644
|
|
|
aca4c4 |
--- a/libxtables/xtables.c
|
|
|
aca4c4 |
+++ b/libxtables/xtables.c
|
|
|
aca4c4 |
@@ -702,6 +702,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
|
|
|
aca4c4 |
struct xtables_match *ptr;
|
|
|
aca4c4 |
const char *icmp6 = "icmp6";
|
|
|
aca4c4 |
bool found = false;
|
|
|
aca4c4 |
+ bool seen = false;
|
|
|
aca4c4 |
|
|
|
aca4c4 |
if (strlen(name) >= XT_EXTENSION_MAXNAMELEN)
|
|
|
aca4c4 |
xtables_error(PARAMETER_PROBLEM,
|
|
|
aca4c4 |
@@ -720,6 +721,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
|
|
|
aca4c4 |
if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
|
|
|
aca4c4 |
ptr = *dptr;
|
|
|
aca4c4 |
*dptr = (*dptr)->next;
|
|
|
aca4c4 |
+ seen = true;
|
|
|
aca4c4 |
if (!found &&
|
|
|
aca4c4 |
xtables_fully_register_pending_match(ptr, prev)) {
|
|
|
aca4c4 |
found = true;
|
|
|
aca4c4 |
@@ -733,6 +735,11 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
|
|
|
aca4c4 |
dptr = &((*dptr)->next);
|
|
|
aca4c4 |
}
|
|
|
aca4c4 |
|
|
|
aca4c4 |
+ if (seen && !found)
|
|
|
aca4c4 |
+ fprintf(stderr,
|
|
|
aca4c4 |
+ "Warning: Extension %s is not supported, missing kernel module?\n",
|
|
|
aca4c4 |
+ name);
|
|
|
aca4c4 |
+
|
|
|
aca4c4 |
for (ptr = xtables_matches; ptr; ptr = ptr->next) {
|
|
|
aca4c4 |
if (extension_cmp(name, ptr->name, ptr->family)) {
|
|
|
aca4c4 |
struct xtables_match *clone;
|
|
|
aca4c4 |
@@ -825,6 +832,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
|
|
|
aca4c4 |
struct xtables_target **dptr;
|
|
|
aca4c4 |
struct xtables_target *ptr;
|
|
|
aca4c4 |
bool found = false;
|
|
|
aca4c4 |
+ bool seen = false;
|
|
|
aca4c4 |
|
|
|
aca4c4 |
/* Standard target? */
|
|
|
aca4c4 |
if (strcmp(name, "") == 0
|
|
|
aca4c4 |
@@ -843,6 +851,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
|
|
|
aca4c4 |
if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
|
|
|
aca4c4 |
ptr = *dptr;
|
|
|
aca4c4 |
*dptr = (*dptr)->next;
|
|
|
aca4c4 |
+ seen = true;
|
|
|
aca4c4 |
if (!found &&
|
|
|
aca4c4 |
xtables_fully_register_pending_target(ptr, prev)) {
|
|
|
aca4c4 |
found = true;
|
|
|
aca4c4 |
@@ -856,6 +865,11 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
|
|
|
aca4c4 |
dptr = &((*dptr)->next);
|
|
|
aca4c4 |
}
|
|
|
aca4c4 |
|
|
|
aca4c4 |
+ if (seen && !found)
|
|
|
aca4c4 |
+ fprintf(stderr,
|
|
|
aca4c4 |
+ "Warning: Extension %s is not supported, missing kernel module?\n",
|
|
|
aca4c4 |
+ name);
|
|
|
aca4c4 |
+
|
|
|
aca4c4 |
for (ptr = xtables_targets; ptr; ptr = ptr->next) {
|
|
|
aca4c4 |
if (extension_cmp(name, ptr->name, ptr->family)) {
|
|
|
aca4c4 |
struct xtables_target *clone;
|
|
|
aca4c4 |
--
|
|
|
aca4c4 |
2.34.1
|
|
|
aca4c4 |
|