Re: [PATCH nf v2] netfilter: nf_tables: fix device name and prefix match in hook lookup

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Aug 24, 2026 at 02:23:49PM +0200, Fernando Fernandez Mancera wrote:
> On 8/24/26 2:21 PM, Pablo Neira Ayuso wrote:
> > Hi Fernando,
> > 
> > On Mon, Aug 24, 2026 at 11:28:05AM +0200, Fernando Fernandez Mancera wrote:
> > > Currently, a netdev chain or flowtable hooked to a device prefix can be
> > > unintentionally deleted by a control-plane request targeting an exact
> > > device name or even a shorter one due to the usage of min() to calculate
> > > the length to match.
> > > 
> > > Fix this by making sure an exact device match never matches a prefix and
> > > that both the target and the candidate have the same length during
> > > delete operation. The add and update paths retain the existing overlap
> > > matching to prevent a single device from matching multiple hooks.
> > 
> > netdev maintainers prefer follow ups for LLM reported issues.
> > 
> > Please, provide an incremental patch for your v1 that we can take in
> > the next PR round.
> > 
> 
> Oh really? Even in this situation?

Yes, this helps reduce pressure on the mailing list.

> Will do once the PR is accepted. The patch won't be much different
> of course.

I guess so, it will be just a simple rebase.

Thanks