]> git.ipfire.org Git - thirdparty/iptables.git/commit
xshared: Fix response to unprivileged users
authorPhil Sutter <phil@nwl.cc>
Tue, 18 Jan 2022 21:39:08 +0000 (22:39 +0100)
committerPhil Sutter <phil@nwl.cc>
Thu, 20 Jan 2022 10:39:30 +0000 (11:39 +0100)
commit26ecdf53960658771c0fc582f72a4025e2887f75
treebf88b64f89db8e71653dbd2050190587f0105bc3
parentb32ae771c8cd7f0b72e4e21cd7d388c745fbae41
xshared: Fix response to unprivileged users

Expected behaviour in both variants is:

* Print help without error, append extension help if -m and/or -j
  options are present
* Indicate lack of permissions in an error message for anything else

With iptables-nft, this was broken basically from day 1. Shared use of
do_parse() then somewhat broke legacy: it started complaining about
inability to create a lock file.

Fix this by making iptables-nft assume extension revision 0 is present
if permissions don't allow to verify. This is consistent with legacy.

Second part is to exit directly after printing help - this avoids having
to make the following code "nop-aware" to prevent privileged actions.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Florian Westphal <fw@strlen.de>
iptables/nft.c
iptables/tests/shell/testcases/iptables/0008-unprivileged_0 [new file with mode: 0755]
iptables/xshared.c