!86 [sync] PR-85: iptables: Fix handling of non-existent chains

From: @openeuler-sync-bot 
Reviewed-by: @robertxw 
Signed-off-by: @robertxw

backport-iptables-Fix-handling-of-non-existent-chains.patch

@@ -0,0 +1,56 @@
+From 82ccfb488eeac5507471099b9b4e6d136cc06e3b Mon Sep 17 00:00:00 2001
+From: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Date: Mon, 19 Jun 2023 13:46:36 +0200
+Subject: iptables: Fix handling of non-existent chains
+
+Since 694612adf87 the "compatibility" check considers non-existent
+chains as "incompatible". This broke some scripts which used calls
+like `iptables -L CHAIN404` to test for chain existence and expect
+"No chain/target/match by that name." in the output.
+
+This patch changes the logic of `nft_is_table_compatible()` to
+report non-existent chains as "compatible" which restores the old
+behavior.
+
+Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks")
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648
+Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com>
+Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Conflict: NA
+Reference: https://git.netfilter.org/iptables/commit?id=82ccfb488eeac5507471099b9b4e6d136cc06e3b
+
+---
+ iptables/nft.c                                              | 2 +-
+ iptables/tests/shell/testcases/iptables/0004-return-codes_0 | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 1cb104e7..020553a4 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -3860,7 +3860,7 @@ bool nft_is_table_compatible(struct nft_handle *h,
+ 	if (chain) {
+ 		struct nft_chain *c = nft_chain_find(h, table, chain);
+ 
+-		return c && !nft_is_chain_compatible(c, h);
++		return !c || !nft_is_chain_compatible(c, h);
+ 	}
+ 
+ 	return !nft_chain_foreach(h, table, nft_is_chain_compatible, h);
+diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
+index 33c5f1f3..234f3040 100755
+--- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0
++++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
+@@ -58,6 +58,7 @@ cmd 1 "$ENOENT" -Z bar
+ cmd 0 -E foo bar
+ cmd 1 "$EEXIST_F" -E foo bar
+ cmd 1 "$ENOENT" -E foo bar2
++cmd 1 "$ENOENT" -L foo
+ cmd 0 -N foo2
+ cmd 1 "$EEXIST_F" -E foo2 bar
+ 
+-- 
+cgit v1.2.3
+

iptables.spec

@@ -2,7 +2,7 @@
 %global legacy_actions %{_libexecdir}/initscripts/legacy-actions
 Name:		  iptables
 Version:	  1.8.7
-Release:	  13
+Release:	  14
 Summary:	  IP packet filter administration utilities
 License:	  GPLv2 and Artistic Licence 2.0 and ISC
 URL:		  https://www.netfilter.org/
@@ -30,8 +30,8 @@ Patch12:          backport-iptables-restore-Free-handle-with-test-also.patch
 Patch13:          backport-nft-Plug-memleak-in-nft_rule_zero_counters.patch
 Patch14:          backport-iptables-Plug-memleaks-in-print_firewall.patch
 Patch15:          backport-ebtables-translate-Print-flush-command-after-parsing-is-finished.patch
-
 Patch16:          backport-xtables-eb-fix-crash-when-opts-isn-t-reallocated.patch
+Patch17:          backport-iptables-Fix-handling-of-non-existent-chains.patch
 
 BuildRequires:    bison flex gcc kernel-headers libpcap-devel libselinux-devel systemd
 BuildRequires:    libmnl-devel libnetfilter_conntrack-devel libnfnetlink-devel libnftnl-devel
@@ -340,6 +340,12 @@ fi
 %{_mandir}/man8/xtables-legacy*
 
 %changelog
+* Mon Aug 14 2023 zhanghao <zhanghao383@huawei.com> - 1.8.7-14
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:iptables: Fix handling of non-existent chains
+
 * Wed Apr 12 2023 zhanghao <zhanghao383@huawei.com> - 1.8.7-13
 - Type:bugfix
 - CVE:NA