Re: [iptables-nft RFC 1/5] nft-shared: dump errors on stdout to garble output

[Phil Sutter <phil@nwl.cc>]

On Wed, Nov 23, 2022 at 01:50:32PM +0100, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > What I don't like about this is that users won't notice the problem
> > until they try to restore the ruleset. For us it is clearly beneficial
> > to see where things break, but I doubt regular users care and we should
> > just tell them to stop mixing iptables and nft calls.
> 
> So what would you propose...?

I like the "table XXX is incompatible" because of how consequent it is.
But this is exactly orthogonal to your emphasis on "print as much as
possible", so not sure if we'll find a compromise. :)

> > Can we maybe add "--force" to iptables-nft-save to make it print as much
> > as possible despite the table being considered incompatible? Not sure
> > how ugly this is to implement, though.
> 
> I don't see this as useful thing because we already have "nft --debug=netlink".

What's your motivation to print parts of the rule which have been parsed
correctly? I assumed it is for debugging purposes.

> > We still exit(0) in case parsing fails, BTW. Guess this is the most
> > important thing to fix despite all the above.
> 
> Huh?
> iptables-restore < bla
> iptables-restore v1.8.8 (nf_tables): unknown option "--bla"
> Error occurred at line: 7 Try `iptables-restore -h' or 'iptables-restore --help' for more information.
> 
> ... exits with 2.
> 
> Can you give an example?

# nft add table ip filter '{ chain FORWARD { \
	type filter hook forward priority filter; \
	ip saddr 10.1.2.3 meta cpu 3 counter accept; }; }'

# nft list ruleset 
table ip filter {
	chain FORWARD {
		type filter hook forward priority filter; policy accept;
		ip saddr 10.1.2.3 meta cpu 3 counter packets 0 bytes 0 accept
	}
}

# iptables-nft -S FORWARD
-P FORWARD ACCEPT
-A FORWARD -s 10.1.2.3/32 -j ACCEPT
# echo $?
0

Note: this is without any of your pending patches applied, I might even
miss pushed commits. I just did this using the current iptables-nft I
have around, but I don't recall any patches changing iptables' return
code if any of the nft_parse_* functions fail.

Cheers, Phil