From 25883ce88bfba087ef142cb909d59dbbc1818b32 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 18 Nov 2022 15:20:32 +0100 Subject: nft: check for unknown meta keys Set ->errmsg when the meta key isn't supported by iptables-nft instead of pretending everything is fine. The old code is good enough to handle rules added by iptables-nft, but its not enough to handle rules added by native nft. At least make sure that there is a an error message telling that iptables-nft could not decode the entire ruleset. Signed-off-by: Florian Westphal --- iptables/nft-bridge.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'iptables/nft-bridge.c') diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c index 749cbc6f..e8ac7a36 100644 --- a/iptables/nft-bridge.c +++ b/iptables/nft-bridge.c @@ -197,7 +197,10 @@ static void nft_bridge_parse_meta(struct nft_xt_ctx *ctx, uint8_t invflags = 0; char iifname[IFNAMSIZ] = {}, oifname[IFNAMSIZ] = {}; - parse_meta(ctx, e, reg->meta_dreg.key, iifname, NULL, oifname, NULL, &invflags); + if (parse_meta(ctx, e, reg->meta_dreg.key, iifname, NULL, oifname, NULL, &invflags) < 0) { + ctx->errmsg = "unknown meta key"; + return; + } switch (reg->meta_dreg.key) { case NFT_META_BRI_IIFNAME: @@ -221,6 +224,7 @@ static void nft_bridge_parse_meta(struct nft_xt_ctx *ctx, snprintf(fw->out, sizeof(fw->out), "%s", oifname); break; default: + ctx->errmsg = "unknown bridge meta key"; break; } } -- cgit v1.2.3