[iptables PATCH] iptables: Fix handling of non-existent chains

[iptables PATCH] iptables: Fix handling of non-existent chains

[Jacek Tomasiak]

Since 694612adf87 the "compatibility" check considers non-existent
chains as "incompatible". This broke some scripts which used calls
like `iptables -L CHAIN404` to test for chain existence and expect
"No chain/target/match by that name." in the output.

This patch changes the logic of `nft_is_table_compatible()` to
report non-existent chains as "compatible" which restores the old
behavior.

Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks")
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648
Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com>
Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com>
---
 iptables/nft.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/iptables/nft.c b/iptables/nft.c
index 1cb104e7..020553a4 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -3860,7 +3860,7 @@ bool nft_is_table_compatible(struct nft_handle *h,
 	if (chain) {
 		struct nft_chain *c = nft_chain_find(h, table, chain);
 
-		return c && !nft_is_chain_compatible(c, h);
+		return !c || !nft_is_chain_compatible(c, h);
 	}
 
 	return !nft_chain_foreach(h, table, nft_is_chain_compatible, h);
-- 
2.35.3

Re: [iptables PATCH] iptables: Fix handling of non-existent chains

[Phil Sutter]

On Mon, Jun 19, 2023 at 01:46:36PM +0200, Jacek Tomasiak wrote:
> Since 694612adf87 the "compatibility" check considers non-existent
> chains as "incompatible". This broke some scripts which used calls
> like `iptables -L CHAIN404` to test for chain existence and expect
> "No chain/target/match by that name." in the output.
> 
> This patch changes the logic of `nft_is_table_compatible()` to
> report non-existent chains as "compatible" which restores the old
> behavior.
> 
> Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks")
> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648
> Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com>
> Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com>

Also applied after adding testsuite coverage to it.

Thanks, Phil