nft: check for unknown meta keys

Set ->errmsg when the meta key isn't supported by iptables-nft instead
of pretending everything is fine.

The old code is good enough to handle rules added by iptables-nft, but
its not enough to handle rules added by native nft.

At least make sure that there is a an error message telling that
iptables-nft could not decode the entire ruleset.

Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
index e9e111416d79bff17c7e16ed5a7e99caa897afb3..59f100af2a6b91b66cf17f57681a809de9368ffa 100644 (file)
--- a/iptables/nft-arp.c
+++ b/iptables/nft-arp.c
@@ -168,11 +168,14 @@ static void nft_arp_parse_meta(struct nft_xt_ctx *ctx,
        struct arpt_entry *fw = &cs->arp;
        uint8_t flags = 0;
 
-       parse_meta(ctx, e, reg->meta_dreg.key, fw->arp.iniface, fw->arp.iniface_mask,
+       if (parse_meta(ctx, e, reg->meta_dreg.key, fw->arp.iniface, fw->arp.iniface_mask,
                   fw->arp.outiface, fw->arp.outiface_mask,
-                  &flags);
+                  &flags) == 0) {
+               fw->arp.invflags |= flags;
+               return;
+       }
 
-       fw->arp.invflags |= flags;
+       ctx->errmsg = "Unknown arp meta key";
 }
 
 static void parse_mask_ipv4(const struct nft_xt_ctx_reg *reg, struct in_addr *mask)

diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
index 749cbc6fbbaf1e3ba9ee278b2b7ef5ca2ceee26d..e8ac7a364169b12c5942aa8235811a9d378429a8 100644 (file)
--- a/iptables/nft-bridge.c
+++ b/iptables/nft-bridge.c
@@ -197,7 +197,10 @@ static void nft_bridge_parse_meta(struct nft_xt_ctx *ctx,
        uint8_t invflags = 0;
        char iifname[IFNAMSIZ] = {}, oifname[IFNAMSIZ] = {};
 
-       parse_meta(ctx, e, reg->meta_dreg.key, iifname, NULL, oifname, NULL, &invflags);
+       if (parse_meta(ctx, e, reg->meta_dreg.key, iifname, NULL, oifname, NULL, &invflags) < 0) {
+               ctx->errmsg = "unknown meta key";
+               return;
+       }
 
        switch (reg->meta_dreg.key) {
        case NFT_META_BRI_IIFNAME:
@@ -221,6 +224,7 @@ static void nft_bridge_parse_meta(struct nft_xt_ctx *ctx,
                snprintf(fw->out, sizeof(fw->out), "%s", oifname);
                break;
        default:
+               ctx->errmsg = "unknown bridge meta key";
                break;
        }
 }

diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 92a914f1a4a41f363eb26f8746bd703d17b68e63..6c62dd46dddacdf3d050083aa780d7922e51a7b4 100644 (file)
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -146,9 +146,12 @@ static void nft_ipv4_parse_meta(struct nft_xt_ctx *ctx,
                break;
        }
 
-       parse_meta(ctx, e, reg->meta_dreg.key, cs->fw.ip.iniface, cs->fw.ip.iniface_mask,
+       if (parse_meta(ctx, e, reg->meta_dreg.key, cs->fw.ip.iniface, cs->fw.ip.iniface_mask,
                   cs->fw.ip.outiface, cs->fw.ip.outiface_mask,
-                  &cs->fw.ip.invflags);
+                  &cs->fw.ip.invflags) == 0)
+               return;
+
+       ctx->errmsg = "unknown ipv4 meta key";
 }
 
 static void parse_mask_ipv4(const struct nft_xt_ctx_reg *sreg, struct in_addr *mask)

diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index 7ca9d842f2b1a6d2898d1d8c2816fcbc88095387..98c35afa67ad901e34975edb616079aab6c7834c 100644 (file)
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -119,9 +119,12 @@ static void nft_ipv6_parse_meta(struct nft_xt_ctx *ctx,
                break;
        }
 
-       parse_meta(ctx, e, reg->meta_dreg.key, cs->fw6.ipv6.iniface,
+       if (parse_meta(ctx, e, reg->meta_dreg.key, cs->fw6.ipv6.iniface,
                   cs->fw6.ipv6.iniface_mask, cs->fw6.ipv6.outiface,
-                  cs->fw6.ipv6.outiface_mask, &cs->fw6.ipv6.invflags);
+                  cs->fw6.ipv6.outiface_mask, &cs->fw6.ipv6.invflags) == 0)
+               return;
+
+       ctx->errmsg = "unknown ipv6 meta key";
 }
 
 static void parse_mask_ipv6(const struct nft_xt_ctx_reg *reg,