Yes the usual wildcard character
* is nft's equivalent of iptables'
+. The man page was not documenting this (relatively old) feature until recently.
From a recent enough
nft man page:
Like with iptables, wildcard matching on interface name prefixes is
oifname matches by appending an asterisk (*)
character. Note however that unlike iptables, nftables does not accept
interface names consisting of the wildcard character only - users are
supposed to just skip those always matching expressions. In order to
match on literal asterisk character, one may escape it using backslash
iifname "veth*" accept
Also, it doesn't appear possible today to use a set of interfaces (
type ifname or
typeof iifname) with a wildcard in an element.
A completely different method to manage interfaces dynamically appearing and disappearing, would be to tag them with a group just after they are created (and probably before they are brought up) and have nftables rules matching an interface's group. eg:
ip link set ppp7 group 42
while having an nftables rule reusing this meta information:
iifgroup 42 jump from-ppp