From: Jakub Kicinski <kuba@kernel.org>
To: Florian Westphal <fw@strlen.de>
Cc: <netdev@vger.kernel.org>, Paolo Abeni <pabeni@redhat.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
<netfilter-devel@vger.kernel.org>,
pablo@netfilter.org
Subject: Re: [PATCH net-next 5/8] netfilter: nf_tables: Introduce NFTA_DEVICE_PREFIX
Date: Mon, 1 Sep 2025 13:46:02 -0700 [thread overview]
Message-ID: <20250901134602.53aaef6b@kernel.org> (raw)
In-Reply-To: <20250901080843.1468-6-fw@strlen.de>
On Mon, 1 Sep 2025 10:08:39 +0200 Florian Westphal wrote:
> This new attribute is supposed to be used instead of NFTA_DEVICE_NAME
> for simple wildcard interface specs. It holds a NUL-terminated string
> representing an interface name prefix to match on.
>
> While kernel code to distinguish full names from prefixes in
> NFTA_DEVICE_NAME is simpler than this solution, reusing the existing
> attribute with different semantics leads to confusion between different
> versions of kernel and user space though:
>
> * With old kernels, wildcards submitted by user space are accepted yet
> silently treated as regular names.
> * With old user space, wildcards submitted by kernel may cause crashes
> since libnftnl expects NUL-termination when there is none.
>
> Using a distinct attribute type sanitizes these situations as the
> receiving part detects and rejects the unexpected attribute nested in
> *_HOOK_DEVS attributes.
>
> Fixes: 6d07a289504a ("netfilter: nf_tables: Support wildcard netdev hook specs")
Why is this not targeting net? The sooner we adjust the uAPI the better.
next prev parent reply other threads:[~2025-09-01 20:46 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-01 8:08 [PATCH net-next 0/8] netfilter: updates for net-next Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 1/8] netfilter: ebtables: Use vmalloc_array() to improve code Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 2/8] netfilter: nft_payload: Use csum_replace4() instead of opencoding Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 3/8] netfilter: nf_tables: allow iter callbacks to sleep Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 4/8] netfilter: nf_tables: all transaction allocations can now sleep Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 5/8] netfilter: nf_tables: Introduce NFTA_DEVICE_PREFIX Florian Westphal
2025-09-01 20:46 ` Jakub Kicinski [this message]
2025-09-01 21:12 ` Pablo Neira Ayuso
2025-09-02 0:04 ` Florian Westphal
2025-09-02 13:03 ` Paolo Abeni
2025-09-01 8:08 ` [PATCH net-next 6/8] netfilter: nft_set_pipapo: remove redundant test for avx feature bit Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 7/8] netfilter: nf_reject: remove unneeded exports Florian Westphal
2025-09-01 8:08 ` [PATCH net-next 8/8] netfilter: nft_payload: extend offset to 65535 bytes Florian Westphal
2025-09-02 10:53 ` [PATCH net-next 0/8] netfilter: updates for net-next Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250901134602.53aaef6b@kernel.org \
--to=kuba@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).