The chain FORWARD looks as follows: <div class="s

reading here <a href="https://pkg.go.dev/github.com/mdlayher/netlink?tab=doc#Attribute

something out of place with BigEndian : <div class

ff ff ff fd would result in <code class="notranslate"

bug: chain name is empty when unpacking expr.Verdict about nftables HOT 7 CLOSED

greenpau commented on May 4, 2024

bug: chain name is empty when unpacking expr.Verdict

from nftables.

Comments (7)

greenpau commented on May 4, 2024

I see that I do get the name in the exprsFromMsg.

nftables/rule.go

Lines 255 to 268 in 7127d9d

 if err := expr.Unmarshal(b, e); err != nil { 

 return err 

 } 

 // Verdict expressions are a special-case of immediate expressions, so 

 // if the expression is an immediate writing nothing into the verdict 

 // register (invalid), re-parse it as a verdict expression. 

 if imm, isImmediate := e.(*expr.Immediate); isImmediate && imm.Register == unix.NFT_REG_VERDICT && len(imm.Data) == 0 { 

 e = &expr.Verdict{} 

 if err := expr.Unmarshal(b, e); err != nil { 

 return err 

 } 

 } 

 exprs = append(exprs, e) 

 return nil

The b looks as follows after the above Unmarshal:

([]uint8) (len=56 cap=56) {
 00000000  08 00 01 00 00 00 00 00  30 00 02 00 2c 00 02 00  |........0...,...|
 00000010  08 00 01 00 ff ff ff fd  1e 00 02 00 63 6e 69 6e  |............cnin|
 00000020  73 2d 33 2d 34 30 32 36  36 31 39 30 38 39 2d 64  |s-3-4026619089-d|
 00000030  75 6d 6d 79 30 00 00 00                           |ummy0...|
}

However, the Verdict unmarshaling does not work and I get:

(*expr.Verdict)(0xc000422ae0)({
 Kind: (expr.VerdictKind) 4294967293,
 Chain: (string) ""
})

from nftables.

greenpau commented on May 4, 2024

Upon further investigation, the following line might be a bug. Replace nestedAD.Bytes()[4:] with nestedAD.Bytes()[:4]

                    e.Kind = VerdictKind(binaryutil.BigEndian.Uint32(nestedAD.Bytes()[4:]))

The issue here is that (nestedAD.Bytes()[4:] is actually the data portion of the verdict, not the kind!

spew.Dump(nestedAD.Bytes())

([]uint8) (len=40 cap=40) {
 00000000  08 00 01 00 ff ff ff fd  1e 00 02 00 63 6e 69 6e  |............cnin|
 00000010  73 2d 33 2d 34 30 32 36  36 33 35 33 39 39 2d 64  |s-3-4026635399-d|
 00000020  75 6d 6d 79 30 00 00 00                           |ummy0...|
}

spew.Dump(nestedAD.Bytes()[4:])

([]uint8) (len=36 cap=36) {
 00000000  ff ff ff fd 1e 00 02 00  63 6e 69 6e 73 2d 33 2d  |........cnins-3-|
 00000010  34 30 32 36 36 33 35 33  39 39 2d 64 75 6d 6d 79  |4026635399-dummy|
 00000020  30 00 00 00                                       |0...|
}

The data portion, i.e. Chain, was not even read into it.

from nftables.

greenpau commented on May 4, 2024

reading here https://pkg.go.dev/github.com/mdlayher/netlink?tab=doc#AttributeDecoder

... what if nestedAD.Bytes()[4:] is correct .... and we need to limit that array to whatever the expected lenght of Kind (int64), 8 bytes?

from nftables.

greenpau commented on May 4, 2024

... what if nestedAD.Bytes()[4:] is correct .... and we need to limit that array to whatever the expected lenght of Kind (int64), 8 bytes?

Not exactly, but close ... need to read nestedAD.Bytes()[8:12] ...

Reading https://www.infradead.org/~tgr/libnl/doc/core.html#core_attr

The first 4 bytes is length.

(*netlink.AttributeDecoder)(0xc0003fed40)(){
 ByteOrder: (binary.littleEndian) LittleEndian,
 attrs: ([]netlink.Attribute) (len=1 cap=1) {
  (netlink.Attribute) {
   Length: (uint16) 44,
   Type: (uint16) 2,
   Data: ([]uint8) (len=40 cap=40) {
    00000000  08 00 01 00 ff ff ff fd  1e 00 02 00 63 6e 69 6e  |............cnin|
    00000010  73 2d 33 2d 34 30 32 36  36 36 37 32 31 38 2d 64  |s-3-4026667218-d|
    00000020  75 6d 6d 79 30 00 00 00                           |ummy0...|
   }
  }
 },
 i: (int) 2,
 err: (error) <nil>
})

from nftables.

greenpau commented on May 4, 2024

something out of place with BigEndian:

e.Kind = VerdictKind(binaryutil.BigEndian.Uint32(nestedAD.Bytes()[8:12]))
spew.Dump(e.Kind)
(expr.VerdictKind) 503316992

vs.

spew.Dump(VerdictJump)
(expr.VerdictKind) -3

from nftables.

greenpau commented on May 4, 2024

ff ff ff fd would result in -3.

Thus reading nestedAD.Bytes()[4:8]

The question remains as to what are the 4-8... padding?

from nftables.

greenpau commented on May 4, 2024

e.Kind = VerdictKind(int32(binaryutil.BigEndian.Uint32(nestedAD.Bytes()[4:8])))

Thinking about 🤔 ... iota vs uint32 ...

from nftables.

bug: chain name is empty when unpacking expr.Verdict about nftables HOT 7 CLOSED

Comments (7)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	if err := expr.Unmarshal(b, e); err != nil {
	return err
	}
	// Verdict expressions are a special-case of immediate expressions, so
	// if the expression is an immediate writing nothing into the verdict
	// register (invalid), re-parse it as a verdict expression.
	if imm, isImmediate := e.(*expr.Immediate); isImmediate && imm.Register == unix.NFT_REG_VERDICT && len(imm.Data) == 0 {
	e = &expr.Verdict{}
	if err := expr.Unmarshal(b, e); err != nil {
	return err
	}
	}
	exprs = append(exprs, e)
	return nil