Re: [PATCH nft] datatype: accept a numeric cgroupsv2 id on input

Pablo Neira Ayuso <[email protected]> Wed, 29 Jul 2026 13:43:50 +0200
Newsgroups gmane.comp.security.firewalls.netfilter.devel
Message-ID <amnndnoOMoR05sJK@chamomile>
On Wed, Jul 29, 2026 at 03:33:56PM +0530, Avinash Duduskar wrote:
> On Wed, Jul 29, 2026 at 11:13:47AM +0200, Phil Sutter wrote:
> > Is it true that integer_type_parse respects negative values as such?
> > Because that void avoid the mentioned issue of '-1' becoming '1'.
> > Negative values would just not match.
> 
> No, the sign parses but is dropped on export: "-1" stores as element 1
> and "-2" then lists as "cgroup.procs". Garbage in, garbage out either
> way, as you say, so v2 delegates to integer_type_parse().
> 
> For the metainfo dump test I will take the jq route, as a follow-up.

Regarding this misparsing of -1, I think this issue is related to the
integer parser, which can be revisited in a follow up patch.

I'd suggest to fix the removal of cgroupsv2 by inode id, then look
into improving the integer parser.