nft: Fix EPERM handling for extensions without rev 0

Treating revision 0 as compatible in EPERM case works fine as long as
there is a revision 0 of that extension defined in DSO. Fix the code for
others: Extend the EPERM handling to all revisions and keep the existing
warning for revision 0.

Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions")
Signed-off-by: Phil Sutter <phil@nwl.cc>

diff --git a/iptables/nft.c b/iptables/nft.c
index 07653ee1a3d6baa29011e2e4fa4c740ea9b85c40..ec79f2bc5e98bce04af9ab58bc38ebd8cc90811b 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -3555,15 +3555,18 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt)
 err:
        mnl_socket_close(nl);
 
-       /* pretend revision 0 is valid -
+       /* ignore EPERM and errors for revision 0 -
         * this is required for printing extension help texts as user, also
         * helps error messaging on unavailable kernel extension */
-       if (ret < 0 && rev == 0) {
-               if (errno != EPERM)
+       if (ret < 0) {
+               if (errno == EPERM)
+                       return 1;
+               if (rev == 0) {
                        fprintf(stderr,
                                "Warning: Extension %s revision 0 not supported, missing kernel module?\n",
                                name);
-               return 1;
+                       return 1;
+               }
        }
 
        return ret < 0 ? 0 : 1;

diff --git a/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0
index 43e3bc8721dbd1a76900cdd608c8478a4e071150..983531fef47200b82c35d4b13c31c76afcbcbadb 100755 (executable)
--- a/iptables/tests/shell/testcases/iptables/0008-unprivileged_0
+++ b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0
@@ -35,6 +35,12 @@ let "rc+=$?"
 grep_or_rc "DNAT target options:" <<< "$out"
 let "rc+=$?"
 
+# TEE has no revision 0
+out=$(run $XT_MULTI iptables -j TEE --help)
+let "rc+=$?"
+grep_or_rc "TEE target options:" <<< "$out"
+let "rc+=$?"
+
 out=$(run $XT_MULTI iptables -p tcp -j DNAT --help)
 let "rc+=$?"
 grep_or_rc "tcp match options:" <<< "$out"