Re: [PATCH nft] datatype: accept a numeric cgroupsv2 id on input

Phil Sutter <[email protected]> Wed, 29 Jul 2026 11:21:22 +0200
Newsgroups gmane.comp.security.firewalls.netfilter.devel
Message-ID <[email protected]>
On Wed, Jul 29, 2026 at 01:49:09AM +0530, Avinash Duduskar wrote:
> On Tue, Jul 28, 2026 at 09:16:54PM +0200, Pablo Neira Ayuso wrote:
> > On Tue, Jul 28, 2026 at 06:19:25PM +0200, Phil Sutter wrote:
> > > So with nft printing non-existent cgroup names using PRIu64 and parsing
> > > code still performs the path lookup first, what is all the fuss about
> > > non-decimal number input?
> >
> > They claim they cannot delete entries via numeric value, it seems.
> 
> Correct, the earlier example proves it.
> 
> A typo'd id can collide with a live inode and then list as another
> cgroup's path. Fine with dropping the checks if you prefer.

Isn't this "garbage in, garbage out" then?

> > > Is this AI output?
> 
> Yes. Point taken on the length.
> 
> > > Can't this just be something like (untested):
> > > [...]
> 
> Yes. v2, keeping the two checks:
> 
> 	if (stat(cgroupv2_path, &st) == 0) {
> 		ino = st.st_ino;
> 	} else if (isdigit((unsigned char)sym->identifier[0])) {
> 		char *end;
> 
> 		errno = 0;
> 		ino = strtoull(sym->identifier, &end, 10);
> 		if (*end != '\0' || errno == ERANGE)
> 			return error(&sym->location, "invalid cgroupv2 id");
> 	} else {
> 		return error(&sym->location, "cgroupv2 path fails: %s",
> 			     strerror(errno));
> 	}
> 
> > > out=$($NFT -j list table t)
> > > [...]
> > > $NFT -j -f - <<< "$out"
> 
> Will do.
> 
> > > Hmm. Looks like we'll have to update all .json-nft files if we ever bump
> > > json_schema_version. Maybe json_pretty should drop that array elem, we
> > > merely keep asserting it exists and that could be done by a dedicated
> > > shell test.
> 
> Can do that as a follow-up if wanted.

It may be a political decision whether that part of JSON output should
be trimmed or not (there was hesitance when I requested to pipe output
through json_pp). So maybe only do it if you don't break a leg over it:
Use jq or awk to eliminate the metainfo object and write a simple test
which asserts its presence in output.

Thanks, Phil