From: Phil Sutter Date: Tue, 10 Mar 2026 16:22:52 +0000 (+0100) Subject: xtables-translate: Return non-zero if translation fails X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=781a87c08be51bd874c196e1555073eb7a3cbc09;p=thirdparty%2Fiptables.git xtables-translate: Return non-zero if translation fails Untranslated parts in output are easily overlooked and also don't disrupt piping into nft (which is a bad idea to begin with), so make a little noise if things go sideways: | # iptables-translate -A FORWARD -m recent --set | nft # -A FORWARD -m recent --set | Translation not (fully) implemented | # cat /tmp/input.ipt | *filter | -A FORWARD -s 1.2.3.4 | -A FORWARD -m recent --set | COMMIT | # iptables-restore-translate -f /tmp/input.ipt | # Translated by iptables-restore-translate v1.8.13 on Tue Mar 10 17:29:17 2026 | add table ip filter | add rule ip filter FORWARD ip saddr 1.2.3.4 counter | # -t filter -A FORWARD -m recent --set | iptables-translate-restore: line 3 failed Signed-off-by: Phil Sutter Acked-by: Florian Westphal --- diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c index 3d8617f0..74cc8eff 100644 --- a/iptables/xtables-translate.c +++ b/iptables/xtables-translate.c @@ -297,8 +297,8 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], switch (p.command) { case CMD_APPEND: - ret = 1; - if (!xlate(h, &p, &cs, &args, true, nft_rule_xlate_add)) + ret = xlate(h, &p, &cs, &args, true, nft_rule_xlate_add); + if (!ret) print_ipt_cmd(argc, argv); break; case CMD_DELETE: @@ -310,8 +310,8 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], case CMD_REPLACE: break; case CMD_INSERT: - ret = 1; - if (!xlate(h, &p, &cs, &args, false, nft_rule_xlate_add)) + ret = xlate(h, &p, &cs, &args, false, nft_rule_xlate_add); + if (!ret) print_ipt_cmd(argc, argv); break; case CMD_FLUSH: @@ -558,7 +558,7 @@ static int xtables_xlate_main(int family, const char *progname, int argc, ret = do_command_xlate(&h, argc, argv, &table, false); if (!ret) - fprintf(stderr, "Translation not implemented\n"); + fprintf(stderr, "Translation not (fully) implemented\n"); nft_fini(&h); xtables_fini();