From 25883ce88bfba087ef142cb909d59dbbc1818b32 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 18 Nov 2022 15:20:32 +0100 Subject: nft: check for unknown meta keys Set ->errmsg when the meta key isn't supported by iptables-nft instead of pretending everything is fine. The old code is good enough to handle rules added by iptables-nft, but its not enough to handle rules added by native nft. At least make sure that there is a an error message telling that iptables-nft could not decode the entire ruleset. Signed-off-by: Florian Westphal --- iptables/nft-ipv6.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'iptables/nft-ipv6.c') diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index 7ca9d842..98c35afa 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -119,9 +119,12 @@ static void nft_ipv6_parse_meta(struct nft_xt_ctx *ctx, break; } - parse_meta(ctx, e, reg->meta_dreg.key, cs->fw6.ipv6.iniface, + if (parse_meta(ctx, e, reg->meta_dreg.key, cs->fw6.ipv6.iniface, cs->fw6.ipv6.iniface_mask, cs->fw6.ipv6.outiface, - cs->fw6.ipv6.outiface_mask, &cs->fw6.ipv6.invflags); + cs->fw6.ipv6.outiface_mask, &cs->fw6.ipv6.invflags) == 0) + return; + + ctx->errmsg = "unknown ipv6 meta key"; } static void parse_mask_ipv6(const struct nft_xt_ctx_reg *reg, -- cgit v1.2.3