Feature, enhancement: Name-based netdev hooks with wildcard support Reason: Previously, nftables in kernel would immediately bind to each specified interface when adding a flowtable or netdev-family chain. A non-existing interface would fail the transaction. Removing an interface (e.g. via driver unload or hardware unplug) would remove matching interface specs from flowtables and even delete whole netdev-family chains bound to it. Result: With this combined feature in kernel and nftables package, defined rulesets remain stable irrespective of interface presence. Hooks for non-existing interfaces are accepted, remain inactive and matching interfaces are bound at the time they appear in the system. The currently active hooks may be inspected via 'nft list hooks' command. This dynamic registration opened the possibility to accept simple interface (suffix) wildcards, used to bind a flowtable or netdev-family chain to any matching interface.