Patchwork iptables: spurious error in load_extension

login
register
mail settings
Submitter Phil Oester
Date Oct. 8, 2013, 4:20 p.m.
Message ID <20131008162015.GB18402@home>
Download mbox | patch
Permalink /patch/281513/
State Accepted
Headers show

Comments

Phil Oester - Oct. 8, 2013, 4:20 p.m.
In commit 927385017047d (iptables: improve error reporting with extension
loading troubles), a new error message was added in an attempt to handle
the case where a match does not support a particular protocol family. 
For instance, attempting to use the osf match on IPv6.

Unfortunately, this error message now triggers when creating a new chain
which has the same name as a match extension, because iptables calls
xtables_find_target with the name of the new chain to verify it does not
clash with an existing target.  For example:

    # iptables -N tcp
    /usr/lib/xtables/libxt_tcp.so: no "tcp" extension found for this protocol

I attempted to resolve this by adding a new XTF flag, but that required changes
in many different places (including -j handling).  It seems easiest just to
remove this warning and stick with the original error message of ENOENT, even
if less than precise. 

Signed-off-by: Phil Oester <kernel@linuxace.com>
Pablo Neira - Nov. 3, 2013, 8:26 p.m.
On Tue, Oct 08, 2013 at 09:20:15AM -0700, Phil Oester wrote:
> In commit 927385017047d (iptables: improve error reporting with extension
> loading troubles), a new error message was added in an attempt to handle
> the case where a match does not support a particular protocol family. 
> For instance, attempting to use the osf match on IPv6.
> 
> Unfortunately, this error message now triggers when creating a new chain
> which has the same name as a match extension, because iptables calls
> xtables_find_target with the name of the new chain to verify it does not
> clash with an existing target.  For example:
> 
>     # iptables -N tcp
>     /usr/lib/xtables/libxt_tcp.so: no "tcp" extension found for this protocol
> 
> I attempted to resolve this by adding a new XTF flag, but that required changes
> in many different places (including -j handling).  It seems easiest just to
> remove this warning and stick with the original error message of ENOENT, even
> if less than precise.

Also applied, thanks Phil.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/libxtables/xtables.c b/libxtables/xtables.c
index 8437baf..fb60c01 100644
--- a/libxtables/xtables.c
+++ b/libxtables/xtables.c
@@ -578,8 +578,6 @@  static void *load_extension(const char *search_path, const char *af_prefix,
 			if (ptr != NULL)
 				return ptr;
 
-			fprintf(stderr, "%s: no \"%s\" extension found for "
-				"this protocol\n", path, name);
 			errno = ENOENT;
 			return NULL;
 		}