From: Jakub Kicinski <kuba@kernel.org>
To: Florian Westphal <fw@strlen.de>
Cc: <netdev@vger.kernel.org>, Paolo Abeni <pabeni@redhat.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
<netfilter-devel@vger.kernel.org>,
pablo@netfilter.org
Subject: Re: [PATCH net-next 5/8] netfilter: nf_tables: Introduce NFTA_DEVICE_PREFIX
Date: Mon, 1 Sep 2025 13:46:02 -0700 [thread overview]
Message-ID: <20250901134602.53aaef6b@kernel.org> (raw)
In-Reply-To: <20250901080843.1468-6-fw@strlen.de>
On Mon, 1 Sep 2025 10:08:39 +0200 Florian Westphal wrote:
> This new attribute is supposed to be used instead of NFTA_DEVICE_NAME
> for simple wildcard interface specs. It holds a NUL-terminated string
> representing an interface name prefix to match on.
>
> While kernel code to distinguish full names from prefixes in
> NFTA_DEVICE_NAME is simpler than this solution, reusing the existing
> attribute with different semantics leads to confusion between different
> versions of kernel and user space though:
>
> * With old kernels, wildcards submitted by user space are accepted yet
> silently treated as regular names.
> * With old user space, wildcards submitted by kernel may cause crashes
> since libnftnl expects NUL-termination when there is none.
>
> Using a distinct attribute type sanitizes these situations as the
> receiving part detects and rejects the unexpected attribute nested in
> *_HOOK_DEVS attributes.
>
> Fixes: 6d07a289504a ("netfilter: nf_tables: Support wildcard netdev hook specs")
Why is this not targeting net? The sooner we adjust the uAPI the better.
next prev parent reply other threads:[~2025-09-01 20:46 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-01 8:08 [PATCH net-next 0/8] netfilter: updates for net-next Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 1/8] netfilter: ebtables: Use vmalloc_array() to improve code Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 2/8] netfilter: nft_payload: Use csum_replace4() instead of opencoding Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 3/8] netfilter: nf_tables: allow iter callbacks to sleep Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 4/8] netfilter: nf_tables: all transaction allocations can now sleep Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 5/8] netfilter: nf_tables: Introduce NFTA_DEVICE_PREFIX Florian Westphal
2025-09-01 20:46 ` Jakub Kicinski [this message]
2025-09-01 21:12 ` Pablo Neira Ayuso
2025-09-02 0:04 ` Florian Westphal
2025-09-02 13:03 ` Paolo Abeni
2025-09-01 8:08 ` [PATCH net-next 6/8] netfilter: nft_set_pipapo: remove redundant test for avx feature bit Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 7/8] netfilter: nf_reject: remove unneeded exports Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 8/8] netfilter: nft_payload: extend offset to 65535 bytes Florian Westphal
2025-09-02 10:53 ` [PATCH net-next 0/8] netfilter: updates for net-next Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250901134602.53aaef6b@kernel.org \
--to=kuba@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.