From 57115dba2fae263b8923cdc5f4a827f49fa680e4 Mon Sep 17 00:00:00 2001 From: Ruben Herold Date: Tue, 4 Aug 2026 13:17:20 +0200 Subject: nat: T9162: fix KeyError when show nat rules has no inbound-interface _get_formatted_output_rules() and _get_formatted_output_statistics() detected an interface match by checking whether *any* expr in the rule has a left.meta field, then unconditionally read expr[0]'s match.right as the interface. Both assumptions are wrong: meta is also used for non-interface matches (e.g. meta l4proto from a protocol match), and the interface match is not guaranteed to be first. For a rule with a protocol match but no inbound-interface, this read the address/port match's right-hand side (a dict) as if it were the interface string, raising KeyError: 0 on interface[0] instead of falling back to 'any'. Search expr entries explicitly for a left.meta.key == 'iifname' match instead, and guard the '@' set-name stripping with a type check. --- src/op_mode/nat.py | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) (limited to 'src') diff --git a/src/op_mode/nat.py b/src/op_mode/nat.py index 434273622..32b62481e 100755 --- a/src/op_mode/nat.py +++ b/src/op_mode/nat.py @@ -142,9 +142,13 @@ def _get_formatted_output_rules(data, direction, family): rule_number = comment.split('-')[-1] rule_number = rule_number.split(' ')[0] if 'expr' in rule['rule']: - interface = rule.get('rule').get('expr')[0].get('match').get('right') \ - if jmespath.search('rule.expr[*].match.left.meta', rule) else 'any' - if interface[0] == '@': + interface = 'any' + for expr in rule.get('rule').get('expr'): + match = expr.get('match') + if match and jmespath.search('left.meta.key', match) == 'iifname': + interface = match.get('right') + break + if isinstance(interface, str) and interface.startswith('@'): interface = interface[3:] for index, match in enumerate(jmespath.search('rule.expr[*].match', rule)): if 'payload' in match['left']: @@ -257,8 +261,14 @@ def _get_formatted_output_statistics(data, direction): rule_number = comment.split('-')[-1] rule_number = rule_number.split(' ')[0] if 'expr' in rule['rule']: - interface = rule.get('rule').get('expr')[0].get('match').get('right') \ - if jmespath.search('rule.expr[*].match.left.meta', rule) else 'any' + interface = 'any' + for expr in rule.get('rule').get('expr'): + match = expr.get('match') + if match and jmespath.search('left.meta.key', match) == 'iifname': + interface = match.get('right') + break + if isinstance(interface, str) and interface.startswith('@'): + interface = interface[3:] packets = jmespath.search('rule.expr[*].counter.packets | [0]', rule) _bytes = jmespath.search('rule.expr[*].counter.bytes | [0]', rule) data_entries.append([rule_number, packets, _bytes, interface]) -- cgit v1.2.3