netdev - Re: [net-next,v7,5/5] doc/netlink: nftables: Fill out operation attributes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260203031905.934693-1-kuba@kernel.org>
Date: Mon,  2 Feb 2026 19:19:05 -0800
From: Jakub Kicinski <kuba@...nel.org>
To: one-d-wide@...tonmail.com
Cc: Jakub Kicinski <kuba@...nel.org>,
	phil@....cc,
	netfilter-devel@...r.kernel.org,
	netdev@...r.kernel.org,
	pablo@...filter.org,
	coreteam@...filter.org,
	fw@...len.de,
	donald.hunter@...il.com
Subject: Re: [net-next,v7,5/5] doc/netlink: nftables: Fill out operation attributes

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.

For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
doc/netlink: nftables: Fill out operation attributes

This commit fills out the operation attributes for 31 nftables netlink
operations, documenting which attributes are used in request and reply
messages based on kernel implementation.

> diff --git a/Documentation/netlink/specs/nftables.yaml b/Documentation/netlink/specs/nftables.yaml
> index ced567e7a521..5a9d8727a8cb 100644
> --- a/Documentation/netlink/specs/nftables.yaml
> +++ b/Documentation/netlink/specs/nftables.yaml

[ ... ]

> @@ -1612,7 +1626,23 @@ operations:
>          request:
>            value: 0xa03
>            attributes:
> +            # Mentioned in nf_tables_newchain()
> +            - table
> +            - handle
> +            - policy
> +            - flags
> +            # Mentioned in nf_tables_updchain()
> +            - hook
>              - name
> +            - counters
> +            - policy
> +            # Mentioned in nf_tables_addchain()
> +            - hook
> +            - name
> +            - counters
> +            - userdata
> +            # Mentioned in nft_chain_parse_hook()
> +            - type

Does this attribute list contain duplicates? The list shows:
- 'policy' twice (lines 1632 and 1638)
- 'hook' twice (lines 1635 and 1640)
- 'name' twice (lines 1636 and 1641)
- 'counters' twice (lines 1637 and 1642)

While the comments indicate these attributes are referenced by different
kernel functions, the YAML specification should document the unified netlink
interface where each attribute appears at most once per message. Having
duplicates may confuse code generation tools that parse this specification.

Should each attribute be listed only once, with implementation details
documented separately if needed?

[ ... ]

> @@ -1717,7 +1798,24 @@ operations:
>          request:
>            value: 0xa09
>            attributes:
> +            # Mentioned in nf_tables_newset()
> +            - table
>              - name
> +            - key-len
> +            - id
> +            - key-type
> +            - key-len
> +            - flags
> +            - data-type
> +            - data-len
> +            - obj-type
> +            - timeout
> +            - gc-interval
> +            - policy
> +            - desc
> +            - table
> +            - name
> +            - userdata

Are there duplicates in this attribute list? Looking at the newset
operation's request attributes:
- 'table' appears twice (lines 1802 and 1816)
- 'name' appears twice (lines 1803 and 1817)
- 'key-len' appears twice (lines 1804 and 1807)

In netlink messages, attributes are identified by their type ID, and each
should appear at most once in the specification. Should these duplicates
be removed?