iptables: Fix handling of non-existent chains

Since 694612adf87 the "compatibility" check considers non-existent
chains as "incompatible". This broke some scripts which used calls
like `iptables -L CHAIN404` to test for chain existence and expect
"No chain/target/match by that name." in the output.

This patch changes the logic of `nft_is_table_compatible()` to
report non-existent chains as "compatible" which restores the old
behavior.

Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks")
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648
Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com>
Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com>
Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/iptables/nft.c b/iptables/nft.c
index 1cb104e75ccc56636e64a7732d61662ef8d51b48..020553a4211d4e81163326d938db9fc735b4a8fa 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -3860,7 +3860,7 @@ bool nft_is_table_compatible(struct nft_handle *h,
        if (chain) {
                struct nft_chain *c = nft_chain_find(h, table, chain);
 
-               return c && !nft_is_chain_compatible(c, h);
+               return !c || !nft_is_chain_compatible(c, h);
        }
 
        return !nft_chain_foreach(h, table, nft_is_chain_compatible, h);

diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
index 33c5f1f35d17f49e245a5bd7bc0c421197d2b472..234f3040516e13cec85d0075cacea984ebfb2167 100755 (executable)
--- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0
+++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
@@ -58,6 +58,7 @@ cmd 1 "$ENOENT" -Z bar
 cmd 0 -E foo bar
 cmd 1 "$EEXIST_F" -E foo bar
 cmd 1 "$ENOENT" -E foo bar2
+cmd 1 "$ENOENT" -L foo
 cmd 0 -N foo2
 cmd 1 "$EEXIST_F" -E foo2 bar