Re: [PATCH nft] datatype: accept a numeric cgroupsv2 id on input

[Avinash Duduskar <avinash.duduskar@gmail.com>]

On Tue, Jul 28, 2026 at 09:16:54PM +0200, Pablo Neira Ayuso wrote:
> On Tue, Jul 28, 2026 at 06:19:25PM +0200, Phil Sutter wrote:
> > So with nft printing non-existent cgroup names using PRIu64 and parsing
> > code still performs the path lookup first, what is all the fuss about
> > non-decimal number input?
>
> They claim they cannot delete entries via numeric value, it seems.

Correct, the earlier example proves it.

A typo'd id can collide with a live inode and then list as another
cgroup's path. Fine with dropping the checks if you prefer.

> > Is this AI output?

Yes. Point taken on the length.

> > Can't this just be something like (untested):
> > [...]

Yes. v2, keeping the two checks:

	if (stat(cgroupv2_path, &st) == 0) {
		ino = st.st_ino;
	} else if (isdigit((unsigned char)sym->identifier[0])) {
		char *end;

		errno = 0;
		ino = strtoull(sym->identifier, &end, 10);
		if (*end != '\0' || errno == ERANGE)
			return error(&sym->location, "invalid cgroupv2 id");
	} else {
		return error(&sym->location, "cgroupv2 path fails: %s",
			     strerror(errno));
	}

> > out=$($NFT -j list table t)
> > [...]
> > $NFT -j -f - <<< "$out"

Will do.

> > Hmm. Looks like we'll have to update all .json-nft files if we ever bump
> > json_schema_version. Maybe json_pretty should drop that array elem, we
> > merely keep asserting it exists and that could be done by a dedicated
> > shell test.

Can do that as a follow-up if wanted.

Avi