diff options
author | Phil Sutter <phil@nwl.cc> | 2022-02-11 17:47:22 +0100 |
---|---|---|
committer | Phil Sutter <phil@nwl.cc> | 2022-03-02 21:18:15 +0100 |
commit | 17534cb18ed0a5052dc45c117401251359dba6aa (patch) | |
tree | 3b518bf12bf91960de76b5811c0d22aa51f2c85c /extensions/libxt_TPROXY.t | |
parent | 2dbb49d15fb44ddd521a734eca3be3f940b7c1ba (diff) |
Improve error messages for unsupported extensions
If a given extension was not supported by the kernel, iptables would
print a rather confusing error message if extension parameters were
given:
| # rm /lib/modules/$(uname -r)/kernel/net/netfilter/xt_LOG.ko
| # iptables -A FORWARD -j LOG --log-prefix foo
| iptables v1.8.7 (legacy): unknown option "--log-prefix"
Avoid this by pretending extension revision 0 is always supported. It is
the same hack as used to successfully print extension help texts as
unprivileged user, extended to all error codes to serve privileged ones
as well.
In addition, print a warning if kernel rejected revision 0 and it's not
a permissions problem. This helps users find out which extension in a
rule the kernel didn't like.
Finally, the above commands result in these messages:
| Warning: Extension LOG revision 0 not supported, missing kernel module?
| iptables: No chain/target/match by that name.
Or, for iptables-nft:
| Warning: Extension LOG revision 0 not supported, missing kernel module?
| iptables v1.8.7 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain FORWARD
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'extensions/libxt_TPROXY.t')
0 files changed, 0 insertions, 0 deletions