MaxKellermann/ferm

Wrong proto gives wrong error

532910 opened this issue · 7 comments

% cat test.conf                            
domain eb table broute chain BROUTING {
  proto IPV4 op-source IP ACCEPT;
}

% /usr/sbin/ferm --remote test.conf       
ebtables --atomic-file /tmp/ferm.6kouSFtJQQ --atomic-save
Error in test.conf line 2:
domain eb table broute chain BROUTING 
{ 
    proto IPV4 op-source <--
Unrecognized keyword: op-source
zsh: exit 25    /usr/sbin/ferm --remote test.conf

It's hard to find the mistake (IPV4 instead of IPv4) in the example above due to the wrong error Unrecognized keyword: op-source.

What is wrong with this error?

It says that op-source is unrecognized keyword, but it is correct.

It is not correct (in this context). Keywords are made known to ferm depending on the context. In this context, it's not a correct keyword.

What is context in this case? If the context is IPV4 so incorrect the context itself, not the op-source keyword.

Anyway, the real error in the example is IPV4 and not op-source so the error message should be about IPV4 and not op-source, do you disagree?

ferm does not validate the proto parameter, because it does not validate any parameter. If it would do that, it would fail every time the kernel adds support for a new protocol.
So how should ferm know that IPV4 is wrong?

but it knows that IPv4 is valid in eb:

ferm/src/ferm

Line 378 in bde1f87

add_proto_def_x 'eb', 'IPv4',

so IPV4 should be invalid, isn't it?

Your example sounds reasonable, but that's a subjective measure. You did not suggest an objective way for ferm to validate the parameter.