Re: [iptables PATCH 2/2] nfnl_osf: Improve error handling

[Phil Sutter <phil@nwl.cc>]

Hi Pablo,

On Sat, May 09, 2020 at 07:28:07PM +0200, Pablo Neira Ayuso wrote:
> On Sat, May 09, 2020 at 01:52:00PM +0200, Phil Sutter wrote:
> > For some error cases, no log message was created - hence apart from the
> > return code there was no indication of failing execution.
> > 
> > When loading a line fails, don't abort but continue with the remaining
> > file contents. The current pf.os file in this repository serves as
> > proof-of-concept: Loading all entries succeeds, but when deleting, lines
> > 700, 701 and 704 return ENOENT. Not continuing means the remaining
> > entries are not cleared.
> 
> Did you look at why are these lines returning ENOENT?

If I understand the code right, line 700 is a duplicate of line 698, 701
of 699 and 704 of 702. This is because 'W*' parses identical to 'W0' and
in right-hand side only the first three text fields (genre, version and
subtype) are relevant - the rest is ignored.

When adding, this doesn't become visible because flag NLM_F_EXCL is not
specified. If it is, kernel returns EEXISTS for those lines.

Cheers, Phil