diff mbox series

[PATCHv5,iproute2] ip route: ignore ENOENT during save if RT_TABLE_MAIN is being dumped

Message ID 20210707122201.14618-1-alexander.mikhalitsyn@virtuozzo.com (mailing list archive)
State Accepted
Commit 459ce6e3d792afe3fe8f7f4b78baa68bb72b8439
Delegated to: David Ahern
Headers show
Series [PATCHv5,iproute2] ip route: ignore ENOENT during save if RT_TABLE_MAIN is being dumped | expand

Checks

Context Check Description
netdev/tree_selection success Not a local patch

Commit Message

Alexander Mikhalitsyn July 7, 2021, 12:22 p.m. UTC
We started to use in-kernel filtering feature which allows to get only
needed tables (see iproute_dump_filter()). From the kernel side it's
implemented in net/ipv4/fib_frontend.c (inet_dump_fib), net/ipv6/ip6_fib.c
(inet6_dump_fib). The problem here is that behaviour of "ip route save"
was changed after
c7e6371bc ("ip route: Add protocol, table id and device to dump request").
If filters are used, then kernel returns ENOENT error if requested table
is absent, but in newly created net namespace even RT_TABLE_MAIN table
doesn't exist. It is really allocated, for instance, after issuing
"ip l set lo up".

Reproducer is fairly simple:
$ unshare -n ip route save > dump
Error: ipv4: FIB table does not exist.
Dump terminated

Expected result here is to get empty dump file (as it was before this
change).

v2: reworked, so, now it takes into account NLMSGERR_ATTR_MSG
(see nl_dump_ext_ack_done() function). We want to suppress error messages
in stderr about absent FIB table from kernel too.

v3: reworked to make code clearer. Introduced rtnl_suppressed_errors(),
rtnl_suppress_error() helpers. User may suppress up to 3 errors (may be
easily extended by changing SUPPRESS_ERRORS_INIT macro).

v4: reworked, rtnl_dump_filter_errhndlr() was introduced. Thanks
to Stephen Hemminger for comments and suggestions

v5: space fixes, commit message reformat, empty initializers

Fixes: c7e6371bc ("ip route: Add protocol, table id and device to dump request")
Cc: David Ahern <dsahern@gmail.com>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Cc: Andrei Vagin <avagin@gmail.com>
Cc: Alexander Mikhalitsyn <alexander@mihalicyn.com>
Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
---
 include/libnetlink.h | 32 ++++++++++++++++++++++++++
 ip/iproute.c         | 15 +++++++++++-
 lib/libnetlink.c     | 54 +++++++++++++++++++++++++++++++++++---------
 3 files changed, 89 insertions(+), 12 deletions(-)

Comments

Stephen Hemminger July 7, 2021, 2:35 p.m. UTC | #1
On Wed,  7 Jul 2021 15:22:01 +0300
Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com> wrote:

> We started to use in-kernel filtering feature which allows to get only
> needed tables (see iproute_dump_filter()). From the kernel side it's
> implemented in net/ipv4/fib_frontend.c (inet_dump_fib), net/ipv6/ip6_fib.c
> (inet6_dump_fib). The problem here is that behaviour of "ip route save"
> was changed after
> c7e6371bc ("ip route: Add protocol, table id and device to dump request").
> If filters are used, then kernel returns ENOENT error if requested table
> is absent, but in newly created net namespace even RT_TABLE_MAIN table
> doesn't exist. It is really allocated, for instance, after issuing
> "ip l set lo up".
> 
> Reproducer is fairly simple:
> $ unshare -n ip route save > dump
> Error: ipv4: FIB table does not exist.
> Dump terminated
> 
> Expected result here is to get empty dump file (as it was before this
> change).
> 
> v2: reworked, so, now it takes into account NLMSGERR_ATTR_MSG
> (see nl_dump_ext_ack_done() function). We want to suppress error messages
> in stderr about absent FIB table from kernel too.
> 
> v3: reworked to make code clearer. Introduced rtnl_suppressed_errors(),
> rtnl_suppress_error() helpers. User may suppress up to 3 errors (may be
> easily extended by changing SUPPRESS_ERRORS_INIT macro).
> 
> v4: reworked, rtnl_dump_filter_errhndlr() was introduced. Thanks
> to Stephen Hemminger for comments and suggestions
> 
> v5: space fixes, commit message reformat, empty initializers
> 
> Fixes: c7e6371bc ("ip route: Add protocol, table id and device to dump request")
> Cc: David Ahern <dsahern@gmail.com>
> Cc: Stephen Hemminger <stephen@networkplumber.org>
> Cc: Andrei Vagin <avagin@gmail.com>
> Cc: Alexander Mikhalitsyn <alexander@mihalicyn.com>
> Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>

Applied this version
Alexander Mikhalitsyn July 7, 2021, 2:38 p.m. UTC | #2
On Wed, 7 Jul 2021 07:35:05 -0700
Stephen Hemminger <stephen@networkplumber.org> wrote:

> On Wed,  7 Jul 2021 15:22:01 +0300
> Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com> wrote:
> 
> > We started to use in-kernel filtering feature which allows to get only
> > needed tables (see iproute_dump_filter()). From the kernel side it's
> > implemented in net/ipv4/fib_frontend.c (inet_dump_fib), net/ipv6/ip6_fib.c
> > (inet6_dump_fib). The problem here is that behaviour of "ip route save"
> > was changed after
> > c7e6371bc ("ip route: Add protocol, table id and device to dump request").
> > If filters are used, then kernel returns ENOENT error if requested table
> > is absent, but in newly created net namespace even RT_TABLE_MAIN table
> > doesn't exist. It is really allocated, for instance, after issuing
> > "ip l set lo up".
> > 
> > Reproducer is fairly simple:
> > $ unshare -n ip route save > dump
> > Error: ipv4: FIB table does not exist.
> > Dump terminated
> > 
> > Expected result here is to get empty dump file (as it was before this
> > change).
> > 
> > v2: reworked, so, now it takes into account NLMSGERR_ATTR_MSG
> > (see nl_dump_ext_ack_done() function). We want to suppress error messages
> > in stderr about absent FIB table from kernel too.
> > 
> > v3: reworked to make code clearer. Introduced rtnl_suppressed_errors(),
> > rtnl_suppress_error() helpers. User may suppress up to 3 errors (may be
> > easily extended by changing SUPPRESS_ERRORS_INIT macro).
> > 
> > v4: reworked, rtnl_dump_filter_errhndlr() was introduced. Thanks
> > to Stephen Hemminger for comments and suggestions
> > 
> > v5: space fixes, commit message reformat, empty initializers
> > 
> > Fixes: c7e6371bc ("ip route: Add protocol, table id and device to dump request")
> > Cc: David Ahern <dsahern@gmail.com>
> > Cc: Stephen Hemminger <stephen@networkplumber.org>
> > Cc: Andrei Vagin <avagin@gmail.com>
> > Cc: Alexander Mikhalitsyn <alexander@mihalicyn.com>
> > Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
> 
> Applied this version

Stephen,

Thank you for your review and suggestions!

Alex
patchwork-bot+netdevbpf@kernel.org July 7, 2021, 2:50 p.m. UTC | #3
Hello:

This patch was applied to iproute2/iproute2.git (refs/heads/main):

On Wed,  7 Jul 2021 15:22:01 +0300 you wrote:
> We started to use in-kernel filtering feature which allows to get only
> needed tables (see iproute_dump_filter()). From the kernel side it's
> implemented in net/ipv4/fib_frontend.c (inet_dump_fib), net/ipv6/ip6_fib.c
> (inet6_dump_fib). The problem here is that behaviour of "ip route save"
> was changed after
> c7e6371bc ("ip route: Add protocol, table id and device to dump request").
> If filters are used, then kernel returns ENOENT error if requested table
> is absent, but in newly created net namespace even RT_TABLE_MAIN table
> doesn't exist. It is really allocated, for instance, after issuing
> "ip l set lo up".
> 
> [...]

Here is the summary with links:
  - [PATCHv5,iproute2] ip route: ignore ENOENT during save if RT_TABLE_MAIN is being dumped
    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=459ce6e3d792

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
Roi Dayan July 11, 2021, 10:59 a.m. UTC | #4
On 2021-07-07 5:50 PM, patchwork-bot+netdevbpf@kernel.org wrote:
> Hello:
> 
> This patch was applied to iproute2/iproute2.git (refs/heads/main):
> 
> On Wed,  7 Jul 2021 15:22:01 +0300 you wrote:
>> We started to use in-kernel filtering feature which allows to get only
>> needed tables (see iproute_dump_filter()). From the kernel side it's
>> implemented in net/ipv4/fib_frontend.c (inet_dump_fib), net/ipv6/ip6_fib.c
>> (inet6_dump_fib). The problem here is that behaviour of "ip route save"
>> was changed after
>> c7e6371bc ("ip route: Add protocol, table id and device to dump request").
>> If filters are used, then kernel returns ENOENT error if requested table
>> is absent, but in newly created net namespace even RT_TABLE_MAIN table
>> doesn't exist. It is really allocated, for instance, after issuing
>> "ip l set lo up".
>>
>> [...]
> 
> Here is the summary with links:
>    - [PATCHv5,iproute2] ip route: ignore ENOENT during save if RT_TABLE_MAIN is being dumped
>      https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=459ce6e3d792
> 
> You are awesome, thank you!
> --
> Deet-doot-dot, I am a bot.
> https://korg.docs.kernel.org/patchwork/pwbot.html
> 
> 


Hi,

I didn't get a chance to check but after this commit the utility ss
is crashing from libnetlink.c

(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x0000000000418980 in rtnl_dump_done (a=0x7fffffffdc00, h=0x449c80) 
at libnetlink.c:734
#2  rtnl_dump_filter_l (rth=rth@entry=0x7fffffffdcf0, 
arg=arg@entry=0x7fffffffdc00) at libnetlink.c:893
#3  0x00000000004197a2 in rtnl_dump_filter_nc 
(rth=rth@entry=0x7fffffffdcf0, filter=filter@entry=0x40cdf0 
<show_one_inet_sock>,
     arg1=arg1@entry=0x7fffffffdca0, nc_flags=nc_flags@entry=0) at 
libnetlink.c:957
#4  0x0000000000406dc7 in inet_show_netlink (dump_fp=dump_fp@entry=0x0, 
protocol=protocol@entry=255, f=0x42e900 <current_filter>) at ss.c:3638
#5  0x0000000000404db3 in raw_show (f=0x42e900 <current_filter>) at 
ss.c:3939


if I revert this commit I can run the ss utility ok.

Thanks,
Roi
Roi Dayan July 11, 2021, 11:09 a.m. UTC | #5
On 2021-07-11 1:59 PM, Roi Dayan wrote:
> 
> 
> On 2021-07-07 5:50 PM, patchwork-bot+netdevbpf@kernel.org wrote:
>> Hello:
>>
>> This patch was applied to iproute2/iproute2.git (refs/heads/main):
>>
>> On Wed,  7 Jul 2021 15:22:01 +0300 you wrote:
>>> We started to use in-kernel filtering feature which allows to get only
>>> needed tables (see iproute_dump_filter()). From the kernel side it's
>>> implemented in net/ipv4/fib_frontend.c (inet_dump_fib), 
>>> net/ipv6/ip6_fib.c
>>> (inet6_dump_fib). The problem here is that behaviour of "ip route save"
>>> was changed after
>>> c7e6371bc ("ip route: Add protocol, table id and device to dump 
>>> request").
>>> If filters are used, then kernel returns ENOENT error if requested table
>>> is absent, but in newly created net namespace even RT_TABLE_MAIN table
>>> doesn't exist. It is really allocated, for instance, after issuing
>>> "ip l set lo up".
>>>
>>> [...]
>>
>> Here is the summary with links:
>>    - [PATCHv5,iproute2] ip route: ignore ENOENT during save if 
>> RT_TABLE_MAIN is being dumped
>>      
>> https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=459ce6e3d792 
>>
>>
>> You are awesome, thank you!
>> -- 
>> Deet-doot-dot, I am a bot.
>> https://korg.docs.kernel.org/patchwork/pwbot.html
>>
>>
> 
> 
> Hi,
> 
> I didn't get a chance to check but after this commit the utility ss
> is crashing from libnetlink.c
> 
> (gdb) bt
> #0  0x0000000000000000 in ?? ()
> #1  0x0000000000418980 in rtnl_dump_done (a=0x7fffffffdc00, h=0x449c80) 
> at libnetlink.c:734
> #2  rtnl_dump_filter_l (rth=rth@entry=0x7fffffffdcf0, 
> arg=arg@entry=0x7fffffffdc00) at libnetlink.c:893
> #3  0x00000000004197a2 in rtnl_dump_filter_nc 
> (rth=rth@entry=0x7fffffffdcf0, filter=filter@entry=0x40cdf0 
> <show_one_inet_sock>,
>      arg1=arg1@entry=0x7fffffffdca0, nc_flags=nc_flags@entry=0) at 
> libnetlink.c:957
> #4  0x0000000000406dc7 in inet_show_netlink (dump_fp=dump_fp@entry=0x0, 
> protocol=protocol@entry=255, f=0x42e900 <current_filter>) at ss.c:3638
> #5  0x0000000000404db3 in raw_show (f=0x42e900 <current_filter>) at 
> ss.c:3939
> 
> 
> if I revert this commit I can run the ss utility ok.
> 
> Thanks,
> Roi

I found for me ss crashed using a->errhndlr but it could be null
in rtnl_dump_done()

I see a second usage of a->errhndlr in rtnl_dump_error()
Alexander Mikhalitsyn July 11, 2021, 11:12 a.m. UTC | #6
Thanks, Roi.

I will send a patch soon.

On Sun, Jul 11, 2021 at 2:09 PM Roi Dayan <roid@nvidia.com> wrote:
>
>
>
> On 2021-07-11 1:59 PM, Roi Dayan wrote:
> >
> >
> > On 2021-07-07 5:50 PM, patchwork-bot+netdevbpf@kernel.org wrote:
> >> Hello:
> >>
> >> This patch was applied to iproute2/iproute2.git (refs/heads/main):
> >>
> >> On Wed,  7 Jul 2021 15:22:01 +0300 you wrote:
> >>> We started to use in-kernel filtering feature which allows to get only
> >>> needed tables (see iproute_dump_filter()). From the kernel side it's
> >>> implemented in net/ipv4/fib_frontend.c (inet_dump_fib),
> >>> net/ipv6/ip6_fib.c
> >>> (inet6_dump_fib). The problem here is that behaviour of "ip route save"
> >>> was changed after
> >>> c7e6371bc ("ip route: Add protocol, table id and device to dump
> >>> request").
> >>> If filters are used, then kernel returns ENOENT error if requested table
> >>> is absent, but in newly created net namespace even RT_TABLE_MAIN table
> >>> doesn't exist. It is really allocated, for instance, after issuing
> >>> "ip l set lo up".
> >>>
> >>> [...]
> >>
> >> Here is the summary with links:
> >>    - [PATCHv5,iproute2] ip route: ignore ENOENT during save if
> >> RT_TABLE_MAIN is being dumped
> >>
> >> https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=459ce6e3d792
> >>
> >>
> >> You are awesome, thank you!
> >> --
> >> Deet-doot-dot, I am a bot.
> >> https://korg.docs.kernel.org/patchwork/pwbot.html
> >>
> >>
> >
> >
> > Hi,
> >
> > I didn't get a chance to check but after this commit the utility ss
> > is crashing from libnetlink.c
> >
> > (gdb) bt
> > #0  0x0000000000000000 in ?? ()
> > #1  0x0000000000418980 in rtnl_dump_done (a=0x7fffffffdc00, h=0x449c80)
> > at libnetlink.c:734
> > #2  rtnl_dump_filter_l (rth=rth@entry=0x7fffffffdcf0,
> > arg=arg@entry=0x7fffffffdc00) at libnetlink.c:893
> > #3  0x00000000004197a2 in rtnl_dump_filter_nc
> > (rth=rth@entry=0x7fffffffdcf0, filter=filter@entry=0x40cdf0
> > <show_one_inet_sock>,
> >      arg1=arg1@entry=0x7fffffffdca0, nc_flags=nc_flags@entry=0) at
> > libnetlink.c:957
> > #4  0x0000000000406dc7 in inet_show_netlink (dump_fp=dump_fp@entry=0x0,
> > protocol=protocol@entry=255, f=0x42e900 <current_filter>) at ss.c:3638
> > #5  0x0000000000404db3 in raw_show (f=0x42e900 <current_filter>) at
> > ss.c:3939
> >
> >
> > if I revert this commit I can run the ss utility ok.
> >
> > Thanks,
> > Roi
>
> I found for me ss crashed using a->errhndlr but it could be null
> in rtnl_dump_done()
>
> I see a second usage of a->errhndlr in rtnl_dump_error()
>
>
diff mbox series

Patch

diff --git a/include/libnetlink.h b/include/libnetlink.h
index b9073a6a..4401551f 100644
--- a/include/libnetlink.h
+++ b/include/libnetlink.h
@@ -104,6 +104,27 @@  struct rtnl_ctrl_data {
 
 typedef int (*rtnl_filter_t)(struct nlmsghdr *n, void *);
 
+/**
+ * rtnl error handler called from
+ *      rtnl_dump_done()
+ *      rtnl_dump_error()
+ *
+ * Return value is a bitmask of the following values:
+ * RTNL_LET_NLERR
+ *      error handled as usual
+ * RTNL_SUPPRESS_NLMSG_DONE_NLERR
+ *      error in nlmsg_type == NLMSG_DONE will be suppressed
+ * RTNL_SUPPRESS_NLMSG_ERROR_NLERR
+ *      error in nlmsg_type == NLMSG_ERROR will be suppressed
+ *      and nlmsg will be skipped
+ * RTNL_SUPPRESS_NLERR - suppress error in both previous cases
+ */
+#define RTNL_LET_NLERR				0x01
+#define RTNL_SUPPRESS_NLMSG_DONE_NLERR		0x02
+#define RTNL_SUPPRESS_NLMSG_ERROR_NLERR		0x04
+#define RTNL_SUPPRESS_NLERR			0x06
+typedef int (*rtnl_err_hndlr_t)(struct nlmsghdr *n, void *);
+
 typedef int (*rtnl_listen_filter_t)(struct rtnl_ctrl_data *,
 				    struct nlmsghdr *n, void *);
 
@@ -113,6 +134,8 @@  typedef int (*nl_ext_ack_fn_t)(const char *errmsg, uint32_t off,
 struct rtnl_dump_filter_arg {
 	rtnl_filter_t filter;
 	void *arg1;
+	rtnl_err_hndlr_t errhndlr;
+	void *arg2;
 	__u16 nc_flags;
 };
 
@@ -121,6 +144,15 @@  int rtnl_dump_filter_nc(struct rtnl_handle *rth,
 			void *arg, __u16 nc_flags);
 #define rtnl_dump_filter(rth, filter, arg) \
 	rtnl_dump_filter_nc(rth, filter, arg, 0)
+int rtnl_dump_filter_errhndlr_nc(struct rtnl_handle *rth,
+				 rtnl_filter_t filter,
+				 void *arg1,
+				 rtnl_err_hndlr_t errhndlr,
+				 void *arg2,
+				 __u16 nc_flags);
+#define rtnl_dump_filter_errhndlr(rth, filter, farg, errhndlr, earg) \
+	rtnl_dump_filter_errhndlr_nc(rth, filter, farg, errhndlr, earg, 0)
+
 int rtnl_talk(struct rtnl_handle *rtnl, struct nlmsghdr *n,
 	      struct nlmsghdr **answer)
 	__attribute__((warn_unused_result));
diff --git a/ip/iproute.c b/ip/iproute.c
index 5853f026..e45f0bea 100644
--- a/ip/iproute.c
+++ b/ip/iproute.c
@@ -1727,6 +1727,18 @@  static int iproute_flush(int family, rtnl_filter_t filter_fn)
 	}
 }
 
+static int save_route_errhndlr(struct nlmsghdr *n, void *arg)
+{
+	int err = -*(int *)NLMSG_DATA(n);
+
+	if (n->nlmsg_type == NLMSG_DONE &&
+	    filter.tb == RT_TABLE_MAIN &&
+	    err == ENOENT)
+		return RTNL_SUPPRESS_NLMSG_DONE_NLERR;
+
+	return RTNL_LET_NLERR;
+}
+
 static int iproute_list_flush_or_save(int argc, char **argv, int action)
 {
 	int dump_family = preferred_family;
@@ -1939,7 +1951,8 @@  static int iproute_list_flush_or_save(int argc, char **argv, int action)
 
 	new_json_obj(json);
 
-	if (rtnl_dump_filter(&rth, filter_fn, stdout) < 0) {
+	if (rtnl_dump_filter_errhndlr(&rth, filter_fn, stdout,
+				      save_route_errhndlr, NULL) < 0) {
 		fprintf(stderr, "Dump terminated\n");
 		return -2;
 	}
diff --git a/lib/libnetlink.c b/lib/libnetlink.c
index c958aa57..e9b8c3bd 100644
--- a/lib/libnetlink.c
+++ b/lib/libnetlink.c
@@ -673,7 +673,8 @@  int rtnl_dump_request_n(struct rtnl_handle *rth, struct nlmsghdr *n)
 	return sendmsg(rth->fd, &msg, 0);
 }
 
-static int rtnl_dump_done(struct nlmsghdr *h)
+static int rtnl_dump_done(struct nlmsghdr *h,
+			  const struct rtnl_dump_filter_arg *a)
 {
 	int len = *(int *)NLMSG_DATA(h);
 
@@ -683,11 +684,15 @@  static int rtnl_dump_done(struct nlmsghdr *h)
 	}
 
 	if (len < 0) {
+		errno = -len;
+
+		if (a->errhndlr(h, a->arg2) & RTNL_SUPPRESS_NLMSG_DONE_NLERR)
+			return 0;
+
 		/* check for any messages returned from kernel */
 		if (nl_dump_ext_ack_done(h, len))
 			return len;
 
-		errno = -len;
 		switch (errno) {
 		case ENOENT:
 		case EOPNOTSUPP:
@@ -708,8 +713,9 @@  static int rtnl_dump_done(struct nlmsghdr *h)
 	return 0;
 }
 
-static void rtnl_dump_error(const struct rtnl_handle *rth,
-			    struct nlmsghdr *h)
+static int rtnl_dump_error(const struct rtnl_handle *rth,
+			    struct nlmsghdr *h,
+			    const struct rtnl_dump_filter_arg *a)
 {
 
 	if (h->nlmsg_len < NLMSG_LENGTH(sizeof(struct nlmsgerr))) {
@@ -721,11 +727,16 @@  static void rtnl_dump_error(const struct rtnl_handle *rth,
 		if (rth->proto == NETLINK_SOCK_DIAG &&
 		    (errno == ENOENT ||
 		     errno == EOPNOTSUPP))
-			return;
+			return -1;
+
+		if (a->errhndlr(h, a->arg2) & RTNL_SUPPRESS_NLMSG_ERROR_NLERR)
+			return 0;
 
 		if (!(rth->flags & RTNL_HANDLE_F_SUPPRESS_NLERR))
 			perror("RTNETLINK answers");
 	}
+
+	return -1;
 }
 
 static int __rtnl_recvmsg(int fd, struct msghdr *msg, int flags)
@@ -834,7 +845,7 @@  static int rtnl_dump_filter_l(struct rtnl_handle *rth,
 					dump_intr = 1;
 
 				if (h->nlmsg_type == NLMSG_DONE) {
-					err = rtnl_dump_done(h);
+					err = rtnl_dump_done(h, a);
 					if (err < 0) {
 						free(buf);
 						return -1;
@@ -845,9 +856,13 @@  static int rtnl_dump_filter_l(struct rtnl_handle *rth,
 				}
 
 				if (h->nlmsg_type == NLMSG_ERROR) {
-					rtnl_dump_error(rth, h);
-					free(buf);
-					return -1;
+					err = rtnl_dump_error(rth, h, a);
+					if (err < 0) {
+						free(buf);
+						return -1;
+					}
+
+					goto skip_it;
 				}
 
 				if (!rth->dump_fp) {
@@ -887,8 +902,25 @@  int rtnl_dump_filter_nc(struct rtnl_handle *rth,
 		     void *arg1, __u16 nc_flags)
 {
 	const struct rtnl_dump_filter_arg a[2] = {
-		{ .filter = filter, .arg1 = arg1, .nc_flags = nc_flags, },
-		{ .filter = NULL,   .arg1 = NULL, .nc_flags = 0, },
+		{ .filter = filter, .arg1 = arg1,
+		  .errhndlr = NULL, .arg2 = NULL, .nc_flags = nc_flags, },
+		{ },
+	};
+
+	return rtnl_dump_filter_l(rth, a);
+}
+
+int rtnl_dump_filter_errhndlr_nc(struct rtnl_handle *rth,
+		     rtnl_filter_t filter,
+		     void *arg1,
+		     rtnl_err_hndlr_t errhndlr,
+		     void *arg2,
+		     __u16 nc_flags)
+{
+	const struct rtnl_dump_filter_arg a[2] = {
+		{ .filter = filter, .arg1 = arg1,
+		  .errhndlr = errhndlr, .arg2 = arg2, .nc_flags = nc_flags, },
+		{ },
 	};
 
 	return rtnl_dump_filter_l(rth, a);