xtables: Make 'iptables -S nonexisting' return non-zero

To be consistent with legacy iptables, calling -S with a non-existing
chain should lead to an error message. This is how some scripts find out
whether a user-defined chain exists or not.

Make sure doing the same for an existing chain does succeed, even if an
invalid rule number was given.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/nft.c b/iptables/nft.c
index ad4f61bbd49ac6e200e81bf16e6f627fe2f94cde..54755fcd1c6acdd63b39e700dae7bb2bde24f43d 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -2201,7 +2201,7 @@ __nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
        struct nftnl_rule_list *list;
        struct nftnl_rule_list_iter *iter;
        struct nftnl_rule *r;
-       int rule_ctr = 0, ret = 0;
+       int rule_ctr = 0;
 
        list = nft_rule_list_get(h);
        if (list == NULL)
@@ -2209,7 +2209,7 @@ __nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
 
        iter = nftnl_rule_list_iter_create(list);
        if (iter == NULL)
-               goto err;
+               return 0;
 
        r = nftnl_rule_list_iter_next(iter);
        while (r != NULL) {
@@ -2230,21 +2230,15 @@ __nft_rule_list(struct nft_handle *h, const char *chain, const char *table,
                }
 
                cb(r, rule_ctr, format);
-               if (rulenum > 0 && rule_ctr == rulenum) {
-                       ret = 1;
+               if (rulenum > 0)
                        break;
-               }
 
 next:
                r = nftnl_rule_list_iter_next(iter);
        }
 
        nftnl_rule_list_iter_destroy(iter);
-err:
-       if (ret == 0)
-               errno = ENOENT;
-
-       return ret;
+       return 1;
 }
 
 static int nft_rule_count(struct nft_handle *h,
@@ -2443,7 +2437,7 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain,
        struct nftnl_chain_list_iter *iter;
        unsigned int format = 0;
        struct nftnl_chain *c;
-       int ret = 1;
+       int ret = 0;
 
        /* If built-in chains don't exist for this table, create them */
        if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0) {

diff --git a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
new file mode 100755 (executable)
index 0000000..c98bdd6
--- /dev/null
+++ b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
@@ -0,0 +1,64 @@
+#!/bin/bash
+
+set -e
+
+$XT_MULTI ip6tables -N foo
+$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT
+$XT_MULTI ip6tables -A FORWARD -i eth42 -o eth23 -g foo
+$XT_MULTI ip6tables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT
+
+EXPECT='-P INPUT ACCEPT
+-P FORWARD ACCEPT
+-P OUTPUT ACCEPT
+-N foo
+-A FORWARD -i eth23 -o eth42 -j ACCEPT
+-A FORWARD -i eth42 -o eth23 -g foo'
+
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S)
+
+EXPECT='-P INPUT ACCEPT -c 0 0
+-P FORWARD ACCEPT -c 0 0
+-P OUTPUT ACCEPT -c 0 0
+-N foo
+-A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
+-A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S)
+
+EXPECT='-P FORWARD ACCEPT
+-A FORWARD -i eth23 -o eth42 -j ACCEPT
+-A FORWARD -i eth42 -o eth23 -g foo'
+
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD)
+
+EXPECT='-P FORWARD ACCEPT -c 0 0
+-A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
+-A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S FORWARD)
+
+EXPECT='-P OUTPUT ACCEPT
+-A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT'
+
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -t nat -S OUTPUT)
+
+EXPECT='-P OUTPUT ACCEPT -c 0 0
+-A OUTPUT -o eth123 -m mark --mark 0x42 -c 0 0 -j ACCEPT'
+
+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -t nat -S OUTPUT)
+
+# some of the following commands are supposed to fail
+set +e
+
+$XT_MULTI ip6tables -S nonexistent && {
+       echo "list-rules in non-existent chain should fail"
+       exit 1
+}
+$XT_MULTI ip6tables -S nonexistent 23 && {
+       echo "list-rules in non-existent chain with given rule number should fail"
+       exit 1
+}
+$XT_MULTI ip6tables -S FORWARD 234 || {
+       echo "list-rules in existent chain with invalid rule number should succeed"
+       exit 1
+}

diff --git a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 b/iptables/tests/shell/testcases/iptables/0003-list-rules_0
index 2e87ce5a6aec04467fd19f9656b05d5b37184026..d335d44257a499a33984b4da2c9abe4b8eb4c4ab 100755 (executable)
--- a/iptables/tests/shell/testcases/iptables/0003-list-rules_0
+++ b/iptables/tests/shell/testcases/iptables/0003-list-rules_0
@@ -46,3 +46,19 @@ EXPECT='-P OUTPUT ACCEPT -c 0 0
 -A OUTPUT -o eth123 -m mark --mark 0x42 -c 0 0 -j ACCEPT'
 
 diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -t nat -S OUTPUT)
+
+# some of the following commands are supposed to fail
+set +e
+
+$XT_MULTI iptables -S nonexistent && {
+       echo "list-rules in non-existent chain should fail"
+       exit 1
+}
+$XT_MULTI iptables -S nonexistent 23 && {
+       echo "list-rules in non-existent chain with given rule number should fail"
+       exit 1
+}
+$XT_MULTI iptables -S FORWARD 234 || {
+       echo "list-rules in existent chain with invalid rule number should succeed"
+       exit 1
+}

diff --git a/iptables/xtables.c b/iptables/xtables.c
index 64081758a12bafbedbb354fd585fed1ced6cfb4e..d9050b45c2c36c6794935edac9ccec3f510e3244 100644 (file)
--- a/iptables/xtables.c
+++ b/iptables/xtables.c
@@ -599,10 +599,7 @@ list_rules(struct nft_handle *h, const char *chain, const char *table,
        if (counters)
            counters = -1;              /* iptables -c format */
 
-       nft_rule_list_save(h, chain, table, rulenum, counters);
-
-       /* iptables does not return error if rule number not found */
-       return 1;
+       return nft_rule_list_save(h, chain, table, rulenum, counters);
 }
 
 static void command_jump(struct iptables_command_state *cs)