From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Mon, 22 Mar 2021 16:57:51 +0000 (+0900)
Subject: firewall-util: gracefully handle -EOVERFLOW returned from older kernel
X-Git-Tag: v248-2~23^2~2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=175bc86315403a6c779530c7f3c495ffe1c2e9ef;p=thirdparty%2Fsystemd.git

firewall-util: gracefully handle -EOVERFLOW returned from older kernel
---

diff --git a/src/shared/firewall-util-nft.c b/src/shared/firewall-util-nft.c
index b661a81ff78..1c6a25c4c0c 100644
--- a/src/shared/firewall-util-nft.c
+++ b/src/shared/firewall-util-nft.c
@@ -943,12 +943,16 @@ static int fw_nftables_add_local_dnat_internal(
                 const union in_addr_union *previous_remote) {
 
         sd_netlink_message *transaction[NFT_DNAT_MSGS] = {};
+        static bool ipv6_supported = true;
         uint32_t data[5], key[2], dlen;
         size_t tsize;
         int r;
 
         assert(add || !previous_remote);
 
+        if (!ipv6_supported && af == AF_INET6)
+                return -EOPNOTSUPP;
+
         if (!IN_SET(protocol, IPPROTO_TCP, IPPROTO_UDP))
                 return -EPROTONOSUPPORT;
 
@@ -1014,7 +1018,16 @@ static int fw_nftables_add_local_dnat_internal(
 
         tsize++;
         assert(tsize <= NFT_DNAT_MSGS);
+
         r = nfnl_netlink_sendv(ctx->nfnl, transaction, tsize);
+        if (r == -EOVERFLOW && af == AF_INET6) {
+                /* The current implementation of DNAT in systemd requires kernel's
+                 * fdb9c405e35bdc6e305b9b4e20ebc141ed14fc81 (v5.8), and the older kernel returns
+                 * -EOVERFLOW. Let's treat the error as -EOPNOTSUPP. */
+                log_debug_errno(r, "The current implementation of IPv6 DNAT in systemd requires kernel 5.8 or newer, ignoring: %m");
+                ipv6_supported = false;
+                r = -EOPNOTSUPP;
+        }
 
 out_unref:
         while (tsize > 0)