From a02b0c39201e268b4ad8f4e4eaf5b3458ed50c2d Mon Sep 17 00:00:00 2001 From: Wang Yu Date: Mon, 14 Sep 2026 14:11:45 +0800 Subject: [PATCH 1/2] fix(net-filter): abort rule loading on invalid config Signed-off-by: Wang Yu --- bpf | 2 +- filter/net-filter.cpp | 32 +++++++++++++++++++++++++++----- 2 files changed, 28 insertions(+), 6 deletions(-) diff --git a/bpf b/bpf index ae7debb..7f7f28a 160000 --- a/bpf +++ b/bpf @@ -1 +1 @@ -Subproject commit ae7debb6bbc03da4312318c2d9faeabcafd1b6ae +Subproject commit 7f7f28a18cf05dba79543ca57cccaa2f41c0541b diff --git a/filter/net-filter.cpp b/filter/net-filter.cpp index ada9ca0..030a569 100644 --- a/filter/net-filter.cpp +++ b/filter/net-filter.cpp @@ -339,29 +339,51 @@ bool NetFilter::load_rules(const char *rule_file) } char *line = NULL; - size_t len; + size_t len = 0; ssize_t read; + unsigned int first_key = key_cnt; + + auto rollback_loaded_rules = [&]() { + for (unsigned int key = first_key; key < key_cnt; key++) + { + del_rule(key); + } + key_cnt = first_key; + }; + while ((read = getline(&line, &len, fp)) != -1) { Rule rule; + char *rule_line = line; - if (line[0] == '#' || line[0] == '\n') + while (*rule_line == ' ' || *rule_line == '\t') { - continue; + rule_line++; } - if (!parse_rule(line, rule)) + if (*rule_line == '#' || *rule_line == '\n' || *rule_line == '\0') { continue; } + if (!parse_rule(rule_line, rule)) + { + pr_error("syntax error in config file\n"); + rollback_loaded_rules(); + free(line); + fclose(fp); + return false; + } + int key; key = add_rule(rule); if (key < 0) { - printf("syntax pr_error in config file\n"); + pr_error("failed to add rule from config file\n"); + rollback_loaded_rules(); + free(line); fclose(fp); return false; } From acf390a2f1e0760b2f61d582ff4533485a9d93f9 Mon Sep 17 00:00:00 2001 From: Wang Yu Date: Wed, 16 Sep 2026 09:16:49 +0800 Subject: [PATCH 2/2] revert(net-filter): restore previous bpf submodule revision --- filter/net-filter.cpp | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/filter/net-filter.cpp b/filter/net-filter.cpp index 030a569..40c7fef 100644 --- a/filter/net-filter.cpp +++ b/filter/net-filter.cpp @@ -339,7 +339,7 @@ bool NetFilter::load_rules(const char *rule_file) } char *line = NULL; - size_t len = 0; + size_t len; ssize_t read; unsigned int first_key = key_cnt; @@ -350,24 +350,20 @@ bool NetFilter::load_rules(const char *rule_file) } key_cnt = first_key; }; - - while ((read = getline(&line, &len, fp)) != -1) { Rule rule; - char *rule_line = line; - while (*rule_line == ' ' || *rule_line == '\t') + while (*line == ' ' || *line == '\t') { - rule_line++; + line++; } - - if (*rule_line == '#' || *rule_line == '\n' || *rule_line == '\0') + if (*line == '#' || *line == '\n' || *line == '\0') { continue; } - if (!parse_rule(rule_line, rule)) + if (!parse_rule(line, rule)) { pr_error("syntax error in config file\n"); rollback_loaded_rules();