[libnftnl PATCH] utils: Drop asterisk from end of NFTA_DEVICE_PREFIX strings

[libnftnl PATCH] utils: Drop asterisk from end of NFTA_DEVICE_PREFIX strings

[Phil Sutter]

The asterisk left in place becomes part of the prefix by accident and is thus
both included when matching interface names as well as dumped back to user
space.

Fixes: f30eae26d813e ("utils: Add helpers for interface name wildcards")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
This code is currently unused by nftables at least since it builds the
netlink message itself.
---
 src/utils.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/utils.c b/src/utils.c
index c4bbd4f7ed171..d73c5f6175802 100644
--- a/src/utils.c
+++ b/src/utils.c
@@ -164,9 +164,16 @@ static bool is_wildcard_str(const char *str)
 
 void nftnl_attr_put_ifname(struct nlmsghdr *nlh, const char *ifname)
 {
-	uint16_t attr = is_wildcard_str(ifname) ?
-			NFTA_DEVICE_PREFIX : NFTA_DEVICE_NAME;
+	uint16_t attr = NFTA_DEVICE_NAME;
+	char pfx[IFNAMSIZ];
 
+	if (is_wildcard_str(ifname)) {
+		snprintf(pfx, IFNAMSIZ, "%s", ifname);
+		pfx[strlen(pfx) - 1] = '\0';
+
+		attr = NFTA_DEVICE_PREFIX;
+		ifname = pfx;
+	}
 	mnl_attr_put_strz(nlh, attr, ifname);
 }
 
-- 
2.51.0

Re: [libnftnl PATCH] utils: Drop asterisk from end of NFTA_DEVICE_PREFIX strings

[Pablo Neira Ayuso]

On Tue, Oct 07, 2025 at 05:58:26PM +0200, Phil Sutter wrote:
> The asterisk left in place becomes part of the prefix by accident and is thus
> both included when matching interface names as well as dumped back to user
> space.
> 
> Fixes: f30eae26d813e ("utils: Add helpers for interface name wildcards")
> Signed-off-by: Phil Sutter <phil@nwl.cc>
> ---
> This code is currently unused by nftables at least since it builds the
> netlink message itself.

This was moved to nftables, and no release was made to include it?
Would it possible to remove it from libnftnl?

Thanks.

Re: [libnftnl PATCH] utils: Drop asterisk from end of NFTA_DEVICE_PREFIX strings

[Phil Sutter]

Hi Pablo,

On Tue, Oct 07, 2025 at 11:42:05PM +0200, Pablo Neira Ayuso wrote:
> On Tue, Oct 07, 2025 at 05:58:26PM +0200, Phil Sutter wrote:
> > The asterisk left in place becomes part of the prefix by accident and is thus
> > both included when matching interface names as well as dumped back to user
> > space.
> > 
> > Fixes: f30eae26d813e ("utils: Add helpers for interface name wildcards")
> > Signed-off-by: Phil Sutter <phil@nwl.cc>
> > ---
> > This code is currently unused by nftables at least since it builds the
> > netlink message itself.
> 
> This was moved to nftables, and no release was made to include it?
> Would it possible to remove it from libnftnl?

The code layout is a bit inconsistent in this regard: While nftables
does the serialization itself (to record offsets for extack), it relies
upon libnftnl to perform the deserialization. Therefore parts of the
wildcard interface feature will have to be spread over the two projects.
And since this is the case, I decided to keep libnftnl's serialization
code "maintained" in this regard, i.e. enable it to perform the netlink
message building for wildcard interface names as well even though there
is no known user for it.

I'd prefer to keep it, also because I see us eventually returning to
libnftnl's serialization code once there is a mechanism to extract the
offsets for extack. You have the last word though (as always)! :)

Cheers, Phil

Re: [libnftnl PATCH] utils: Drop asterisk from end of NFTA_DEVICE_PREFIX strings

[Pablo Neira Ayuso]

On Wed, Oct 08, 2025 at 12:05:53AM +0200, Phil Sutter wrote:
> Hi Pablo,
> 
> On Tue, Oct 07, 2025 at 11:42:05PM +0200, Pablo Neira Ayuso wrote:
> > On Tue, Oct 07, 2025 at 05:58:26PM +0200, Phil Sutter wrote:
> > > The asterisk left in place becomes part of the prefix by accident and is thus
> > > both included when matching interface names as well as dumped back to user
> > > space.
> > > 
> > > Fixes: f30eae26d813e ("utils: Add helpers for interface name wildcards")
> > > Signed-off-by: Phil Sutter <phil@nwl.cc>
> > > ---
> > > This code is currently unused by nftables at least since it builds the
> > > netlink message itself.
> > 
> > This was moved to nftables, and no release was made to include it?
> > Would it possible to remove it from libnftnl?
> 
> The code layout is a bit inconsistent in this regard: While nftables
> does the serialization itself (to record offsets for extack), it relies
> upon libnftnl to perform the deserialization. Therefore parts of the
> wildcard interface feature will have to be spread over the two projects.
> And since this is the case, I decided to keep libnftnl's serialization
> code "maintained" in this regard, i.e. enable it to perform the netlink
> message building for wildcard interface names as well even though there
> is no known user for it.
> 
> I'd prefer to keep it, also because I see us eventually returning to
> libnftnl's serialization code once there is a mechanism to extract the
> offsets for extack. You have the last word though (as always)! :)

LGTM, thanks for explaining.

Re: [libnftnl PATCH] utils: Drop asterisk from end of NFTA_DEVICE_PREFIX strings

[Phil Sutter]

On Wed, Oct 15, 2025 at 12:33:44AM +0200, Pablo Neira Ayuso wrote:
> On Wed, Oct 08, 2025 at 12:05:53AM +0200, Phil Sutter wrote:
> > Hi Pablo,
> > 
> > On Tue, Oct 07, 2025 at 11:42:05PM +0200, Pablo Neira Ayuso wrote:
> > > On Tue, Oct 07, 2025 at 05:58:26PM +0200, Phil Sutter wrote:
> > > > The asterisk left in place becomes part of the prefix by accident and is thus
> > > > both included when matching interface names as well as dumped back to user
> > > > space.
> > > > 
> > > > Fixes: f30eae26d813e ("utils: Add helpers for interface name wildcards")
> > > > Signed-off-by: Phil Sutter <phil@nwl.cc>
> > > > ---
> > > > This code is currently unused by nftables at least since it builds the
> > > > netlink message itself.
> > > 
> > > This was moved to nftables, and no release was made to include it?
> > > Would it possible to remove it from libnftnl?
> > 
> > The code layout is a bit inconsistent in this regard: While nftables
> > does the serialization itself (to record offsets for extack), it relies
> > upon libnftnl to perform the deserialization. Therefore parts of the
> > wildcard interface feature will have to be spread over the two projects.
> > And since this is the case, I decided to keep libnftnl's serialization
> > code "maintained" in this regard, i.e. enable it to perform the netlink
> > message building for wildcard interface names as well even though there
> > is no known user for it.
> > 
> > I'd prefer to keep it, also because I see us eventually returning to
> > libnftnl's serialization code once there is a mechanism to extract the
> > offsets for extack. You have the last word though (as always)! :)
> 
> LGTM, thanks for explaining.

Patch applied, thanks!