arptables: Warn when ignoring '-p' option

Legacy arptables has been silently ignoring this flag (plus mandatory
argument) since day 1. Retain compatibility to that behaviour but inform
users that a part of their rule does nothing.

Since arp is the only family which didn't provide a proto_parse
callback, implement one for the sole purpose of printing the warning. As
a side-effect, caller no longer has to check callback's existence.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
index 2140a88d4a6a99a98bc259b4235dab148657130d..d1e352e54f97c92ab28c54069db9c4832c42be1b 100644 (file)
--- a/iptables/nft-arp.c
+++ b/iptables/nft-arp.c
@@ -452,6 +452,13 @@ out_err:
        return ret;
 }
 
        return ret;
 }
 

+static void nft_arp_proto_parse_warn(struct iptables_command_state *cs,
+                                    struct xtables_args *args)
+{
+       fprintf(stderr,
+               "Warning: Ignoring '-p' option not supported by arptables\n");
+}
+

 static void nft_arp_post_parse(int command,
                               struct iptables_command_state *cs,
                               struct xtables_args *args)
 static void nft_arp_post_parse(int command,
                               struct iptables_command_state *cs,
                               struct xtables_args *args)


@@ -831,6 +838,7 @@ struct nft_family_ops nft_family_ops_arp = {
        .save_chain             = nft_arp_save_chain,
        .rule_parse             = &nft_ruleparse_ops_arp,
        .cmd_parse              = {
        .save_chain             = nft_arp_save_chain,
        .rule_parse             = &nft_ruleparse_ops_arp,
        .cmd_parse              = {

+               .proto_parse    = nft_arp_proto_parse_warn,

                .post_parse     = nft_arp_post_parse,
                .option_name    = nft_arp_option_name,
                .option_invert  = nft_arp_option_invert,
                .post_parse     = nft_arp_post_parse,
                .option_name    = nft_arp_option_name,
                .option_invert  = nft_arp_option_invert,

diff --git a/iptables/xshared.c b/iptables/xshared.c
index 26e91e370eb8493ebc70c21aef7ba25507cdcc5f..263dcc32e5eb1a5dce18b68f7e7c32b9dbc53625 100644 (file)
--- a/iptables/xshared.c
+++ b/iptables/xshared.c
@@ -1657,8 +1657,7 @@ void do_parse(int argc, char *argv[],
                        cs->protocol = optarg;
 
                        /* This needs to happen here to parse extensions */
                        cs->protocol = optarg;
 
                        /* This needs to happen here to parse extensions */

-                       if (p->ops->proto_parse)
-                               p->ops->proto_parse(cs, args);
+                       p->ops->proto_parse(cs, args);

                        break;
 
                case 's':
                        break;
 
                case 's':