Re: [nf-next PATCH] netfilter: nfnetlink_hook: Dump nat type chains

[Phil Sutter <phil@nwl.cc>]

On Fri, Mar 20, 2026 at 12:18:31PM +0100, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > On Fri, Mar 20, 2026 at 11:17:00AM +0100, Phil Sutter wrote:
> > [...]
> > > A remark from a practical perspective: Florian's suggestion to dump the
> > > nat-type chains in their order with the dispatcher's priority value is
> > > super-easy to implement (just have to pass the priority value to
> > > nfnl_hook_dump_one() via parameter) and does not require adjustments in
> > > user space.
> > 
> > Famous last words. :(
> 
> diff --git a/src/mnl.c b/src/mnl.c
> index 4893af8322ae..b9efd3cfd3ce 100644
> --- a/src/mnl.c
> +++ b/src/mnl.c
> @@ -2520,7 +2520,7 @@ static void basehook_list_add_tail(struct basehook *b, struct list_head *head)
>                         continue;
>                 if (!basehook_eq(hook, b))
>                         continue;
> -               if (hook->prio < b->prio)
> +               if (hook->prio <= b->prio)
>                         continue;
>  
>                 list_add(&b->list, &hook->list);
> 
> ?

Sure, but <=nftables-1.1.6 will still get it wrong. Can we tolerate
that?