To be consistent with legacy iptables, calling -S with a non-existing chain should lead to an error message. This is how some scripts find out whether a user-defined chain exists or not.
Make sure doing the same for an existing chain does succeed, even if an invalid rule number was given. Signed-off-by: Phil Sutter <[email protected]> --- iptables/nft.c | 16 ++--- .../testcases/ip6tables/0003-list-rules_0 | 64 +++++++++++++++++++ .../testcases/iptables/0003-list-rules_0 | 16 +++++ iptables/xtables.c | 5 +- 4 files changed, 86 insertions(+), 15 deletions(-) create mode 100755 iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 diff --git a/iptables/nft.c b/iptables/nft.c index ad4f61bbd49ac..54755fcd1c6ac 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -2201,7 +2201,7 @@ __nft_rule_list(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule_list *list; struct nftnl_rule_list_iter *iter; struct nftnl_rule *r; - int rule_ctr = 0, ret = 0; + int rule_ctr = 0; list = nft_rule_list_get(h); if (list == NULL) @@ -2209,7 +2209,7 @@ __nft_rule_list(struct nft_handle *h, const char *chain, const char *table, iter = nftnl_rule_list_iter_create(list); if (iter == NULL) - goto err; + return 0; r = nftnl_rule_list_iter_next(iter); while (r != NULL) { @@ -2230,21 +2230,15 @@ __nft_rule_list(struct nft_handle *h, const char *chain, const char *table, } cb(r, rule_ctr, format); - if (rulenum > 0 && rule_ctr == rulenum) { - ret = 1; + if (rulenum > 0) break; - } next: r = nftnl_rule_list_iter_next(iter); } nftnl_rule_list_iter_destroy(iter); -err: - if (ret == 0) - errno = ENOENT; - - return ret; + return 1; } static int nft_rule_count(struct nft_handle *h, @@ -2443,7 +2437,7 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain, struct nftnl_chain_list_iter *iter; unsigned int format = 0; struct nftnl_chain *c; - int ret = 1; + int ret = 0; /* If built-in chains don't exist for this table, create them */ if (nft_xtables_config_load(h, XTABLES_CONFIG_DEFAULT, 0) < 0) { diff --git a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 new file mode 100755 index 0000000000000..c98bdd6e501aa --- /dev/null +++ b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 @@ -0,0 +1,64 @@ +#!/bin/bash + +set -e + +$XT_MULTI ip6tables -N foo +$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT +$XT_MULTI ip6tables -A FORWARD -i eth42 -o eth23 -g foo +$XT_MULTI ip6tables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT + +EXPECT='-P INPUT ACCEPT +-P FORWARD ACCEPT +-P OUTPUT ACCEPT +-N foo +-A FORWARD -i eth23 -o eth42 -j ACCEPT +-A FORWARD -i eth42 -o eth23 -g foo' + +diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S) + +EXPECT='-P INPUT ACCEPT -c 0 0 +-P FORWARD ACCEPT -c 0 0 +-P OUTPUT ACCEPT -c 0 0 +-N foo +-A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT +-A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' + +diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S) + +EXPECT='-P FORWARD ACCEPT +-A FORWARD -i eth23 -o eth42 -j ACCEPT +-A FORWARD -i eth42 -o eth23 -g foo' + +diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD) + +EXPECT='-P FORWARD ACCEPT -c 0 0 +-A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT +-A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' + +diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S FORWARD) + +EXPECT='-P OUTPUT ACCEPT +-A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT' + +diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -t nat -S OUTPUT) + +EXPECT='-P OUTPUT ACCEPT -c 0 0 +-A OUTPUT -o eth123 -m mark --mark 0x42 -c 0 0 -j ACCEPT' + +diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -t nat -S OUTPUT) + +# some of the following commands are supposed to fail +set +e + +$XT_MULTI ip6tables -S nonexistent && { + echo "list-rules in non-existent chain should fail" + exit 1 +} +$XT_MULTI ip6tables -S nonexistent 23 && { + echo "list-rules in non-existent chain with given rule number should fail" + exit 1 +} +$XT_MULTI ip6tables -S FORWARD 234 || { + echo "list-rules in existent chain with invalid rule number should succeed" + exit 1 +} diff --git a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 b/iptables/tests/shell/testcases/iptables/0003-list-rules_0 index 2e87ce5a6aec0..d335d44257a49 100755 --- a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 +++ b/iptables/tests/shell/testcases/iptables/0003-list-rules_0 @@ -46,3 +46,19 @@ EXPECT='-P OUTPUT ACCEPT -c 0 0 -A OUTPUT -o eth123 -m mark --mark 0x42 -c 0 0 -j ACCEPT' diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -t nat -S OUTPUT) + +# some of the following commands are supposed to fail +set +e + +$XT_MULTI iptables -S nonexistent && { + echo "list-rules in non-existent chain should fail" + exit 1 +} +$XT_MULTI iptables -S nonexistent 23 && { + echo "list-rules in non-existent chain with given rule number should fail" + exit 1 +} +$XT_MULTI iptables -S FORWARD 234 || { + echo "list-rules in existent chain with invalid rule number should succeed" + exit 1 +} diff --git a/iptables/xtables.c b/iptables/xtables.c index 64081758a12ba..d9050b45c2c36 100644 --- a/iptables/xtables.c +++ b/iptables/xtables.c @@ -599,10 +599,7 @@ list_rules(struct nft_handle *h, const char *chain, const char *table, if (counters) counters = -1; /* iptables -c format */ - nft_rule_list_save(h, chain, table, rulenum, counters); - - /* iptables does not return error if rule number not found */ - return 1; + return nft_rule_list_save(h, chain, table, rulenum, counters); } static void command_jump(struct iptables_command_state *cs) -- 2.18.0
