diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-03-10 19:20:50 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-03-11 22:11:34 +0100 |
| commit | 573788e053631a5c069f887caed7c62d521b022d (patch) | |
| tree | bfac46e2c63dc9b6577a40a65ba91e793b859695 /src/evaluate.c | |
| parent | 8c75d3a169605b605711ccb6f4ab3253c40ba10b (diff) | |
src: improve error reporting for unsupported chain type
8c75d3a16960 ("Reject invalid chain priority values in user space")
provides error reporting from the evaluation phase. Instead, this patch
infers the error after the kernel reports EOPNOTSUPP.
test.nft:3:28-40: Error: Chains of type "nat" must have a priority value above -200
type nat hook prerouting priority -300;
^^^^^^^^^^^^^
This patch also adds another common issue for users compiling their own
kernels if they forget to enable CONFIG_NFT_NAT in their .config file.
Acked-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/evaluate.c')
| -rw-r--r-- | src/evaluate.c | 9 |
1 files changed, 0 insertions, 9 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 663ace26..47caf3b0 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -4885,8 +4885,6 @@ static int chain_evaluate(struct eval_ctx *ctx, struct chain *chain) } if (chain->flags & CHAIN_F_BASECHAIN) { - int priority; - chain->hook.num = str2hooknum(chain->handle.family, chain->hook.name); if (chain->hook.num == NF_INET_NUMHOOKS) @@ -4899,13 +4897,6 @@ static int chain_evaluate(struct eval_ctx *ctx, struct chain *chain) return __stmt_binary_error(ctx, &chain->priority.loc, NULL, "invalid priority expression %s in this context.", expr_name(chain->priority.expr)); - - mpz_export_data(&priority, chain->priority.expr->value, - BYTEORDER_HOST_ENDIAN, sizeof(int)); - if (priority <= -200 && !strcmp(chain->type.str, "nat")) - return __stmt_binary_error(ctx, &chain->priority.loc, NULL, - "Chains of type \"nat\" must have a priority value above -200."); - if (chain->policy) { expr_set_context(&ctx->ectx, &policy_type, NFT_NAME_MAXLEN * BITS_PER_BYTE); |