FIB objects not present when reading

[aojea]

Repro

nft --debug=netlink insert rule inet cni-kindnet output fib daddr type local
inet cni-kindnet output
  [ fib daddr type => reg 1 ]
  [ cmp eq reg 1 0x00000002 ]

gives

nft list chain inet cni-kindnet output
table inet cni-kindnet {
        chain output {
                type nat hook output priority -100; policy accept;
                fib daddr type local
        }
}

Using my "hacky" golang dumper https://gist.github.com/aojea/8a811e11a060fa638aa2dd8165960d5a

/nfroundtrip cni-kindnet output
2025/01/02 15:51:48 rule position 0
&expr.Cmp{Op:0x0, Register:0x1, Data:[]uint8{0x2, 0x0, 0x0, 0x0}}

right expressions with golang

		// only packets destined to local addresses
		&expr.Fib{
			Register:       1,
			FlagDADDR:      true,
			ResultADDRTYPE: true,
		},
		&expr.Cmp{
			// [ cmp eq reg 1 0x00000002 ]
			Op:       expr.CmpOpEq,
			Register: 1,
			Data:     encodeWithAlignment(byte(unix.RTN_LOCAL)),
		},

so it seems the parsing is not working as expected? it is missing the FIB object

[turekt]

Good catch. I fixed it by adding expr name to exprFromName function.

# go run main.go cni-kindnet output
2025/01/15 00:37:58 rule position 0
&expr.Fib{Register:0x1, ResultOIF:true, ResultOIFNAME:false, ResultADDRTYPE:false, FlagSADDR:false, FlagDADDR:false, FlagMARK:false, FlagIIF:false, FlagOIF:false, FlagPRESENT:false}
&expr.Cmp{Op:0x0, Register:0x1, Data:[]uint8{0x2, 0x0, 0x0, 0x0}}

As you can see, this still did not produce the correct result so I made a few changes to fib marshaling as well. Now it seems to work as expected:

# go run dumper.go filter test-chain
2025/01/15 01:38:45 rule position 0
&expr.Fib{Register:0x1, ResultOIF:false, ResultOIFNAME:false, ResultADDRTYPE:true, FlagSADDR:false, FlagDADDR:true, FlagMARK:false, FlagIIF:false, FlagOIF:false, FlagPRESENT:false}
&expr.Cmp{Op:0x0, Register:0x1, Data:[]uint8{0x2, 0x0, 0x0, 0x0}}

The issue should be resolved once the PR #296 is merged.

[turekt]

Hi @aojea,

the PR is now merged. If your case works correctly, I suggest that this issue is closed.

[aojea]

Thanks for the prompt response