chaitin / chaitin/SafeLine

[Bug] POST `/api/open/policy` Fails with `internal-error` Due to FSL Compilation Failure in `safeline-mgt`

Open
#1,193 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
22.6k
Forks
1.5k
Avg merge
4h 30m
Merged PRs (30d)
11

Description

What happened?

When sending a POST request to https://localhost:9443/api/open/policy to create a new policy, the API returns an internal-error response with the message "compiling failed: compiling FSL failed". The GET request to the same endpoint succeeds, indicating the API is accessible, but the POST operation fails. The error is logged in the safeline-mgt container, pointing to an issue with FSL (Filter Specification Language) compilation in the fvm service.

How we reproduce?
  1. Set up the environment using the provided docker-compose.yml and .env files:
    • .env:
      SAFELINE_DIR=./data/safeline
      IMAGE_TAG=latest
      MGT_PORT=9443
      POSTGRES_PASSWORD=xxx
      SUBNET_PREFIX=172.22.222
      IMAGE_PREFIX=chaitin
      ARCH_SUFFIX=
      RELEASE=
      REGION=-g
      
    • Relevant docker-compose.yml services: safeline-mgt, safeline-fvm, safeline-pg (full configuration provided in the original context).
  2. Start the services:
    docker-compose up -d
    
  3. Verify the safeline-mgt service is running by sending a GET request:
    curl -k https://localhost:9443/api/open/policy -H "X-SLCE-API-TOKEN: Your API Token"
    
    This should return a successful response.
  4. Send a POST request to create a policy:
    curl -k -X POST https://localhost:9443/api/open/policy \
    -H "Content-Type: application/json" \
    -H "X-SLCE-API-TOKEN: Your API Token" \
    -d '{
        "name": "IPBlock",
        "is_enabled": true,
        "pattern": [
            [
                {
                    "k": "src_ip",
                    "op": "in",
                    "v": [
                        "172.19.0.1"
                    ],
                    "sub_k": ""
                }
            ]
        ],
        "action": 1,
        "expire": 174854302,
        "log": true,
        "level": 0
    }'
    
  5. Observe the response and check the safeline-mgt container logs:
    docker logs safeline-mgt
    
Expected behavior

The POST request to /api/open/policy should successfully create the policy and return a success response (e.g., HTTP 200 or 201 with a confirmation message, such as {"data": {...}, "msg": "success"}).

Error log

The safeline-mgt container logs show the following errors:

safeline-mgt  | 2025/05/29 10:42:18 [ERROR] fvm fvm/grpc_helper.go:76 FVM AppendFSL Close Error rpc error: code = Unknown desc = compiling failed: compiling FSL failed
safeline-mgt  | 2025/05/29 10:42:18 [ERROR] fvm fvm/grpc_helper.go:80 FVM AppendFSL Close Error rpc error: code = Unknown desc = compiling failed: compiling FSL failed
safeline-mgt  | 2025/05/29 10:42:18 [ERROR] fvm fvm/policy_rule.go:66 compile and push fsl error: rpc error: code = Unknown desc = compiling failed: compiling FSL failed
safeline-mgt  | 2025/05/29 10:42:18 [ERROR] api.policy gin@v1.10.0/context.go:185 create policy error: rules compile error, please check your params

The 'safeline-fvm' container logs show the following errors:

safeline-fvm  | time="2025-05-29T10:42:18Z" level=error msg="AppendFSL: compiling failed: compiling FSL failed"

API response:

{
    "data": {},
    "msg": "internal-error"
}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the POST to /api/open/policy with the supplied docker-compose.yml and inspect the safeline-mgt and safeline-fvm logs. Start with fvm/grpc_helper.go and fvm/policy_rule.go, then trace the FSL compilation failure. Done means the request creates the policy successfully and no longer returns internal-error or compiling failed.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
api, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.