Bug 1994141

User experienced example at

https://github.com/aborrero/python-nftables-tutorial/blob/main/nft-load-example-ruleset.py

but call abort with the output:

INFO: running json cmd: {'nftables': [{'flush': {'ruleset': None}}, {'add': {'table': {'family': 'inet', 'name': 'mytable'}}}, {'add': {'chain': {'family': 'inet', 'table': 'mytable', 'chain': 'mychain'}}}, {'add': {'rule': {'family': 'inet', 'table': 'mytable', 'chain': 'mychain', 'expr': [{'match': {'left': {'payload': {'protocol': 'tcp', 'field': 'dport'}}, 'right': 22}}, {'accept': None}]}}}]}
BUG: invalid input descriptor type 1435367392
python3: erec.c:117: erec_print: Assertion `0' failed.

  From gdb we see:

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50	  return ret;
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff665bb25 in __GI_abort () at abort.c:79
#2  0x00007ffff665b9f9 in __assert_fail_base (fmt=0x7ffff67c1c28 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x7ffff565d1c5 "0", file=0x7ffff565d1ee "erec.c", line=117, function=<optimized out>) at assert.c:92
#3  0x00007ffff6669cc6 in __GI___assert_fail (assertion=assertion@entry=0x7ffff565d1c5 "0", file=file@entry=0x7ffff565d1ee "erec.c", line=line@entry=117, function=function@entry=0x7ffff565d2d8 <__PRETTY_FUNCTION__.12288> "erec_print")
    at assert.c:101
#4  0x00007ffff562e91b in erec_print (octx=octx@entry=0x5555557b0ac0, erec=erec@entry=0x5555558df7e0, debug_mask=debug_mask@entry=0) at erec.c:117
#5  0x00007ffff562e989 in erec_print_list (octx=octx@entry=0x5555557b0ac0, list=list@entry=0x7fffffffd0a0, debug_mask=0) at erec.c:190
#6  0x00007ffff56343cc in nft_run_cmd_from_buffer (nft=0x5555557b0aa0, buf=<optimized out>) at libnftables.c:461
...
(gdb) f 4
#4  0x00007ffff562e91b in erec_print (octx=octx@entry=0x5555557b0ac0, erec=erec@entry=0x5555558df7e0, debug_mask=debug_mask@entry=0) at erec.c:117
117			BUG("invalid input descriptor type %u\n", indesc->type);
(gdb) set print pretty on
(gdb) p *erec
$1 = {
  list = {
    next = 0x12345678, 
    prev = 0x87654321
  }, 
  type = EREC_ERROR, 
  num_locations = 1, 
  locations = {{
      indesc = 0x7fffffffcff0, 
      {
        {
          token_offset = 0, 
          line_offset = 0, 
          first_line = 1, 
          last_line = 1, 
          first_column = 4, 
          last_column = 4
        }, 
        {
          nle = 0x0
        }
      }
    }, {
      indesc = 0x7ffff7e2d150, 
      {
        {
          token_offset = -162492999864514345, 
          line_offset = 140737352233328, 
          first_line = 4158837136, 
          last_line = 32767, 
          first_column = 2661444742, 
          last_column = 315850313
        }, 
        {
          nle = 0xfdbeb57a409688d7
        }
      }
    }, {
      indesc = 0x7ffff7e2f1b0, 
      {
        {
          token_offset = 140737346724160, 
          line_offset = -3365638462354366012, 
          first_line = 4158870848, 
          last_line = 32767, 
          first_column = 4079197856, 
          last_column = 32767
        }, 
        {
          nle = 0x7ffff78ee140
        }
      }
    }}, 
  msg = 0x555555898810 "Object item not found: name"
}

  So, it looks like it should first check if 'erec' is of type 'EREC_ERROR', and if
that is the case, likely not check 'indesc', but print the error and exit. That is,
instead of the above output, likely, should have printed:

"""
INFO: running json cmd: {'nftables': [{'flush': {'ruleset': None}}, {'add': {'table': {'family': 'inet', 'name': 'mytable'}}}, {'add': {'chain': {'family': 'inet', 'table': 'mytable', 'chain': 'mychain'}}}, {'add': {'rule': {'family': 'inet', 'table': 'mytable', 'chain': 'mychain', 'expr': [{'match': {'left': {'payload': {'protocol': 'tcp', 'field': 'dport'}}, 'right': 22}}, {'accept': None}]}}}]}
Error: Object item not found: name
"""

and exited, instead of the misleading type error message and the abort.