ABI Breakage - nftnl_rule_parse_attr_cb

ABI Breakage - nftnl_rule_parse_attr_cb

[Kiernan George]

Hi,

I am getting an ABI breakage error at these lines in rule.c:

case NFTA_RULE_HANDLE:
         if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
             abi_breakage();
         break;

It only seems to happen when I set the flag NLM_F_ECHO in 
nftnl_rule_nlmsg_build_hdr. I want to hold onto the rule handle of the 
returned rule, which is why I set it to echo. This error was not 
affecting me in Ubuntu 20.04, but started as soon as I upgraded to 
22.04. I am running Linux kernel version 5.15.0-39-generic with 
libnftnl-dev version 1.2.1-1build1.

Thanks,

Kiernan

Re: ABI Breakage - nftnl_rule_parse_attr_cb

[Pablo Neira Ayuso]

On Tue, Jun 21, 2022 at 08:07:24PM +0000, Kiernan George wrote:
> Hi,
> 
> I am getting an ABI breakage error at these lines in rule.c:
> 
> case NFTA_RULE_HANDLE:
>         if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
>             abi_breakage();
>         break;
> 
> It only seems to happen when I set the flag NLM_F_ECHO in
> nftnl_rule_nlmsg_build_hdr. I want to hold onto the rule handle of the
> returned rule, which is why I set it to echo. This error was not affecting
> me in Ubuntu 20.04, but started as soon as I upgraded to 22.04. I am running
> Linux kernel version 5.15.0-39-generic with libnftnl-dev version
> 1.2.1-1build1.

That's very strange. Could you post a sample code?

Re: ABI Breakage - nftnl_rule_parse_attr_cb

[Kiernan George]

This is the relevant line where I build my header:
nlh = nftnl_rule_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch),
NFT_MSG_NEWRULE, family, NLM_F_APPEND | NLM_F_EXCL | NLM_F_CREATE |
NLM_F_ECHO | NLM_F_ACK, seq++);

If I remove NLM_F_ECHO, it fixes my issue, but I would prefer to keep
this unless there is a better way to get the created rule's handle. I
also set the handle directly:
mnl_attr_put_u64(nlh, NFTNL_RULE_POSITION, htobe64(handle));


On Wed, Jun 22, 2022 at 3:36 AM Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>
> On Tue, Jun 21, 2022 at 08:07:24PM +0000, Kiernan George wrote:
> > Hi,
> >
> > I am getting an ABI breakage error at these lines in rule.c:
> >
> > case NFTA_RULE_HANDLE:
> >         if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
> >             abi_breakage();
> >         break;
> >
> > It only seems to happen when I set the flag NLM_F_ECHO in
> > nftnl_rule_nlmsg_build_hdr. I want to hold onto the rule handle of the
> > returned rule, which is why I set it to echo. This error was not affecting
> > me in Ubuntu 20.04, but started as soon as I upgraded to 22.04. I am running
> > Linux kernel version 5.15.0-39-generic with libnftnl-dev version
> > 1.2.1-1build1.
>
> That's very strange. Could you post a sample code?

Re: ABI Breakage - nftnl_rule_parse_attr_cb

[Pablo Neira Ayuso]

On Wed, Jun 22, 2022 at 09:24:25AM -0400, Kiernan George wrote:
> This is the relevant line where I build my header:
> nlh = nftnl_rule_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch),
> NFT_MSG_NEWRULE, family, NLM_F_APPEND | NLM_F_EXCL | NLM_F_CREATE |
> NLM_F_ECHO | NLM_F_ACK, seq++);
> 
> If I remove NLM_F_ECHO, it fixes my issue, but I would prefer to keep
> this unless there is a better way to get the created rule's handle. I
> also set the handle directly:
> mnl_attr_put_u64(nlh, NFTNL_RULE_POSITION, htobe64(handle));

Makes no sense. Flags are irrelevant for the ABI breakage you are
reporting. Send us a reproducer.

Re: ABI Breakage - nftnl_rule_parse_attr_cb

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Jun 22, 2022 at 09:24:25AM -0400, Kiernan George wrote:
> > This is the relevant line where I build my header:
> > nlh = nftnl_rule_nlmsg_build_hdr(mnl_nlmsg_batch_current(batch),
> > NFT_MSG_NEWRULE, family, NLM_F_APPEND | NLM_F_EXCL | NLM_F_CREATE |
> > NLM_F_ECHO | NLM_F_ACK, seq++);
> > 
> > If I remove NLM_F_ECHO, it fixes my issue, but I would prefer to keep
> > this unless there is a better way to get the created rule's handle. I
> > also set the handle directly:
> > mnl_attr_put_u64(nlh, NFTNL_RULE_POSITION, htobe64(handle));
> 
> Makes no sense. Flags are irrelevant for the ABI breakage you are
> reporting. Send us a reproducer.

Probably corrupted or too-small receive buffer w. garbage fed into
netlink parser.

Impossible to say without reproducer.