google / nftables

This repository contains a Go module to interact with Linux nftables (the iptables successor).
Apache License 2.0
1.11k stars 136 forks source link

[GetSets] Fetching Sets from table with maps fails #171

Open ziggie1984 opened 2 years ago

ziggie1984 commented 2 years ago

Problem1

As soon as I want to fetch Sets of a table which has a map included the nflib reports an error:

Error Fetching Sets - could not determine data type 1cd

When I delete the Map Fetching Sets works perfect.

Problem 2

Fetching tables reports very high numbers for Use uint32 // NFTA_TABLE_USE (Number of chains in table) for example:

Table has only 2 chains but GetTable reports very high number:

2022/06/07 09:41:28 &{filter 100663296 0 1}

Is there maybe a short workaround to make it work?

stapelberg commented 2 years ago

I don’t understand what the problems are. At the very minimum, please always include a standalone program that illustrates what the problem is.

You might have to dig into the code yourself to fix this in the short term, I don’t know how much time I have to look into this.

ziggie1984 commented 1 year ago

Ok, will fix the issue, we need to also check for concatenation types when fetching the sets otherwise the types will not match. I did neglect the error in my custom software but now I need a fix, will create a PR this week

ziggie1984 commented 1 year ago

FYI:

The problem lies here: https://github.com/google/nftables/blob/main/set.go#L705

In case the datatype is concatenated we need to call the validateKeyType Function which will fix the issue and check if all concatenated types are valid.

invalidMagic, ok := validateKeyType(nftMagic); !ok {
                return nil, fmt.Errorf("could not determine data type %+v", invalidMagic)
            } 
ziggie1984 commented 1 year ago

Will run some more tests maybe also include the possibility to decode a concatenated type (separate function), so that one can easily compare the data types before changing the set.