From 83241d3f173dd57c3fdc347490213776a070fa40 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Wed, 23 Nov 2022 14:44:22 +0100 Subject: iptables-nft: exit nonzero when iptables-save cannot decode all expressions We always return 0, even if we printed some error message half-way. Increment an error counter whenever an error message was printed so that the chain-loop can exit with an error if this counter is nonzero. Another effect is that iptables-save will no longer print the COMMIT line anmore. Reported-by: Phil Sutter Signed-off-by: Florian Westphal Acked-by: Phil Sutter --- iptables/nft.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'iptables/nft.h') diff --git a/iptables/nft.h b/iptables/nft.h index 68b0910c..caff1fde 100644 --- a/iptables/nft.h +++ b/iptables/nft.h @@ -203,7 +203,7 @@ enum nft_rule_print { NFT_RULE_DEL, }; -void nft_rule_print_save(struct nft_handle *h, const struct nftnl_rule *r, +bool nft_rule_print_save(struct nft_handle *h, const struct nftnl_rule *r, enum nft_rule_print type, unsigned int format); uint32_t nft_invflags2cmp(uint32_t invflags, uint32_t flag); -- cgit v1.2.3