Re: [PATCH iptables-nft] iptables-nft: exit nonzero when iptables-save cannot decode all expressions

[Phil Sutter <phil@nwl.cc>]

On Wed, Nov 23, 2022 at 02:49:29PM +0100, Florian Westphal wrote:
> We always return 0, even if we printed some error message half-way.
> Increment an error counter whenever an error message was printed so that
> the chain-loop can exit with an error if this counter is nonzero.
> 
> Another effect is that iptables-restore won't have a chance to print the
                                  ~~~~~~~
*save?

[...]
> diff --git a/iptables/nft.c b/iptables/nft.c
> index 4c0110bb8040..67c5877ce9cc 100644
> --- a/iptables/nft.c
> +++ b/iptables/nft.c
[...]
> @@ -1919,6 +1927,9 @@ int nft_rule_save(struct nft_handle *h, const char *table, unsigned int format)
>  
>  	ret = nft_chain_foreach(h, table, nft_rule_save_cb, &d);
>  
> +	if (ret == 0 && d.errors)
> +		xtables_error(VERSION_PROBLEM, "Cannot decode all rules provided by kernel");

*by the kernel?

My English is certainly worse than yours, though. :D

Apart from that,

Acked-by: Phil Sutter <phil@nwl.cc>

Thanks!