1From 17534cb18ed0a5052dc45c117401251359dba6aa Mon Sep 17 00:00:00 2001 2From: Phil Sutter <phil@nwl.cc> 3Date: Fri, 11 Feb 2022 17:47:22 +0100 4Subject: Improve error messages for unsupported extensions 5 6If a given extension was not supported by the kernel, iptables would 7print a rather confusing error message if extension parameters were 8given: 9 10| # rm /lib/modules/$(uname -r)/kernel/net/netfilter/xt_LOG.ko 11| # iptables -A FORWARD -j LOG --log-prefix foo 12| iptables v1.8.7 (legacy): unknown option "--log-prefix" 13 14Avoid this by pretending extension revision 0 is always supported. It is 15the same hack as used to successfully print extension help texts as 16unprivileged user, extended to all error codes to serve privileged ones 17as well. 18 19In addition, print a warning if kernel rejected revision 0 and it's not 20a permissions problem. This helps users find out which extension in a 21rule the kernel didn't like. 22 23Finally, the above commands result in these messages: 24 25| Warning: Extension LOG revision 0 not supported, missing kernel 26module? 27| iptables: No chain/target/match by that name. 28 29Or, for iptables-nft: 30 31| Warning: Extension LOG revision 0 not supported, missing kernel 32module? 33| iptables v1.8.7 (nf_tables): RULE_APPEND failed (No such file or 34directory): rule in chain FORWARD 35 36Conflict: NA 37Reference: 38https://git.netfilter.org/iptables/commit/?id=17534cb18ed0a5052dc45c117401251359dba6aa 39Signed-off-by: Phil Sutter <phil@nwl.cc> 40--- 41 iptables/nft.c | 13 +++++++++---- 42 libxtables/xtables.c | 7 ++++++- 43 2 files changed, 15 insertions(+), 5 deletions(-) 44 45diff --git a/iptables/nft.c b/iptables/nft.c 46index c9a4940..18bf21c 100644 47--- a/iptables/nft.c 48+++ b/iptables/nft.c 49@@ -3245,11 +3245,16 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt) 50 err: 51 mnl_socket_close(nl); 52 53- /* pretend revision 0 is valid if not permitted to check - 54- * this is required for printing extension help texts as user */ 55- if (ret < 0 && errno == EPERM && rev == 0) 56+ /* pretend revision 0 is valid - 57+ * this is required for printing extension help texts as user, also 58+ * helps error messaging on unavailable kernel extension */ 59+ if (ret < 0 && rev == 0) { 60+ if (errno != EPERM) 61+ fprintf(stderr, 62+ "Warning: Extension %s revision 0 not supported, missing kernel module?\n", 63+ name); 64 return 1; 65- 66+ } 67 return ret < 0 ? 0 : 1; 68 } 69 70diff --git a/libxtables/xtables.c b/libxtables/xtables.c 71index bc42ba8..1f585e5 100644 72--- a/libxtables/xtables.c 73+++ b/libxtables/xtables.c 74@@ -923,7 +923,12 @@ int xtables_compatible_revision(const char *name, uint8_t revision, int opt) 75 /* Definitely don't support this? */ 76 if (errno == ENOENT || errno == EPROTONOSUPPORT) { 77 close(sockfd); 78- return 0; 79+ /* Pretend revision 0 support for better error messaging */ 80+ if (revision == 0) 81+ fprintf(stderr, 82+ "Warning: Extension %s revision 0 not supported, missing kernel module?\n", 83+ name); 84+ return (revision == 0); 85 } else if (errno == ENOPROTOOPT) { 86 close(sockfd); 87 /* Assume only revision 0 support (old kernel) */ 88-- 892.23.0 90 91