Re: [PATCH nft] datatype: accept a numeric cgroupsv2 id on input
Phil Sutter <[email protected]> Wed, 29 Jul 2026 11:21:22 +0200
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel |
|---|---|
| Message-ID | <[email protected]> |
On Wed, Jul 29, 2026 at 01:49:09AM +0530, Avinash Duduskar wrote:
> On Tue, Jul 28, 2026 at 09:16:54PM +0200, Pablo Neira Ayuso wrote:
> > On Tue, Jul 28, 2026 at 06:19:25PM +0200, Phil Sutter wrote:
> > > So with nft printing non-existent cgroup names using PRIu64 and parsing
> > > code still performs the path lookup first, what is all the fuss about
> > > non-decimal number input?
> >
> > They claim they cannot delete entries via numeric value, it seems.
>
> Correct, the earlier example proves it.
>
> A typo'd id can collide with a live inode and then list as another
> cgroup's path. Fine with dropping the checks if you prefer.
Isn't this "garbage in, garbage out" then?
> > > Is this AI output?
>
> Yes. Point taken on the length.
>
> > > Can't this just be something like (untested):
> > > [...]
>
> Yes. v2, keeping the two checks:
>
> if (stat(cgroupv2_path, &st) == 0) {
> ino = st.st_ino;
> } else if (isdigit((unsigned char)sym->identifier[0])) {
> char *end;
>
> errno = 0;
> ino = strtoull(sym->identifier, &end, 10);
> if (*end != '\0' || errno == ERANGE)
> return error(&sym->location, "invalid cgroupv2 id");
> } else {
> return error(&sym->location, "cgroupv2 path fails: %s",
> strerror(errno));
> }
>
> > > out=$($NFT -j list table t)
> > > [...]
> > > $NFT -j -f - <<< "$out"
>
> Will do.
>
> > > Hmm. Looks like we'll have to update all .json-nft files if we ever bump
> > > json_schema_version. Maybe json_pretty should drop that array elem, we
> > > merely keep asserting it exists and that could be done by a dedicated
> > > shell test.
>
> Can do that as a follow-up if wanted.
It may be a political decision whether that part of JSON output should
be trimmed or not (there was hesitance when I requested to pipe output
through json_pp). So maybe only do it if you don't break a leg over it:
Use jq or awk to eliminate the metainfo object and write a simple test
which asserts its presence in output.
Thanks, Phil