1From 82ccfb488eeac5507471099b9b4e6d136cc06e3b Mon Sep 17 00:00:00 2001 2From: Jacek Tomasiak <jacek.tomasiak@gmail.com> 3Date: Mon, 19 Jun 2023 13:46:36 +0200 4Subject: iptables: Fix handling of non-existent chains 5 6Since 694612adf87 the "compatibility" check considers non-existent 7chains as "incompatible". This broke some scripts which used calls 8like `iptables -L CHAIN404` to test for chain existence and expect 9"No chain/target/match by that name." in the output. 10 11This patch changes the logic of `nft_is_table_compatible()` to 12report non-existent chains as "compatible" which restores the old 13behavior. 14 15Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks") 16Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648 17Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com> 18Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com> 19Signed-off-by: Phil Sutter <phil@nwl.cc> 20 21Conflict: NA 22Reference: https://git.netfilter.org/iptables/commit?id=82ccfb488eeac5507471099b9b4e6d136cc06e3b 23 24--- 25 iptables/nft.c | 2 +- 26 iptables/tests/shell/testcases/iptables/0004-return-codes_0 | 1 + 27 2 files changed, 2 insertions(+), 1 deletion(-) 28 29diff --git a/iptables/nft.c b/iptables/nft.c 30index 1cb104e7..020553a4 100644 31--- a/iptables/nft.c 32+++ b/iptables/nft.c 33@@ -3860,7 +3860,7 @@ bool nft_is_table_compatible(struct nft_handle *h, 34 if (chain) { 35 struct nft_chain *c = nft_chain_find(h, table, chain); 36 37- return c && !nft_is_chain_compatible(c, h); 38+ return !c || !nft_is_chain_compatible(c, h); 39 } 40 41 return !nft_chain_foreach(h, table, nft_is_chain_compatible, h); 42diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0 43index 33c5f1f3..234f3040 100755 44--- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 45+++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0 46@@ -58,6 +58,7 @@ cmd 1 "$ENOENT" -Z bar 47 cmd 0 -E foo bar 48 cmd 1 "$EEXIST_F" -E foo bar 49 cmd 1 "$ENOENT" -E foo bar2 50+cmd 1 "$ENOENT" -L foo 51 cmd 0 -N foo2 52 cmd 1 "$EEXIST_F" -E foo2 bar 53 54-- 55cgit v1.2.3 56 57