Re: [PATCH nf-next 3/4] netfilter: x_tables: do not print specified table

On Tuesday 2026-08-18 14:27, Pablo Neira Ayuso wrote:

>This is defensive, possibly this string has been already been sanitized
>but simply print that this match/target extension can only be used for a
>given table.

>@@ -95,8 +95,7 @@ static int rpfilter_check(const struct xt_mtchk_param *par)
> 
> 	if (strcmp(par->table, "mangle") != 0 &&
> 	    strcmp(par->table, "raw") != 0) {
>-		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table, not \'%s\'\n",
>-				    par->table);
>+		pr_info_ratelimited("only valid in \'raw\' or \'mangle\' table\n");
> 		return -EINVAL;
> 	}

You have now robbed the user of information where the problem
originated from (and thus removed an avenue on further diagnosis /
remediation), which is one of the classic UI/UX sins[1].

(There should be countless webpages out there that can explain
better than me what's a good and what's a bad error message.)

The table names were historically static, and always valid. The only
requirement is that the string is \0-terminated. That should be true
even for nftables. The use of NLA_STRING for NFTA_TABLE_NAME should
enforce this at the netlink level already.

(Ironically, since C lacks a managed type like std::string, there is
less incentive to even have {ptr, len}-type string objects/views.)