This new attribute is supposed to be used instead of NFTA_DEVICE_NAME for simple wildcard interface specs. It holds a NUL-terminated string representing an interface name prefix to match on. While kernel code to distinguish full names from prefixes in NFTA_DEVICE_NAME is simpler than this solution, reusing the existing attribute with different semantics leads to confusion between different versions of kernel and user space though: * With old kernels, wildcards submitted by user space are accepted yet silently treated as regular names. * With old user space, wildcards submitted by kernel may cause crashes since libnftnl expects NUL-termination when there is none. Using a distinct attribute type sanitizes these situations as the receiving part detects and rejects the unexpected attribute nested in *_HOOK_DEVS attributes.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -1784,10 +1784,12 @@ enum nft_synproxy_attributes { · 1783 unmodified lines | ||
| 1784 | 1784 | * enum nft_device_attributes - nf_tables device netlink attributes |
| 1785 | 1785 | * |
| 1786 | 1786 | * @NFTA_DEVICE_NAME: name of this device (NLA_STRING) |
| 1787 | + * @NFTA_DEVICE_PREFIX: device name prefix, a simple wildcard (NLA_STRING) | |
| 1787 | 1788 | */ |
| 1788 | 1789 | enum nft_devices_attributes { |
| 1789 | 1790 | NFTA_DEVICE_UNSPEC, |
| 1790 | 1791 | NFTA_DEVICE_NAME, |
| 1792 | + NFTA_DEVICE_PREFIX, | |
| 1791 | 1793 | __NFTA_DEVICE_MAX |
| 1792 | 1794 | }; |
| 1793 | 1795 | #define NFTA_DEVICE_MAX (__NFTA_DEVICE_MAX - 1) |