Re: [PATCH nf] netfilter: nf_tables: validate objref and objrefmap expressions

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Fernando,

On Sun, Oct 05, 2025 at 01:04:24AM +0200, Fernando Fernandez Mancera wrote:
[...]
> To avoid such situations, implement objref and objrefmap expression
> validate function. Currently, only NFT_OBJECT_SYNPROXY object type
> requires validation. This will also handle a jump to a chain using a
> synproxy object from the OUTPUT hook.
> 
> Now when trying to reference a synproxy object in the OUTPUT hook, nft
> will produce the following error:
> 
> synproxy_crash.nft:11:3-26: Error: Could not process rule: Operation not supported
> 		synproxy name mysynproxy
> 		^^^^^^^^^^^^^^^^^^^^^^^^

Object maps only store one type of object, ie. all objects are of the
same type.

        if (nla[NFTA_SET_OBJ_TYPE] != NULL) {
                if (!(flags & NFT_SET_OBJECT))
                        return -EINVAL;

                desc.objtype = ntohl(nla_get_be32(nla[NFTA_SET_OBJ_TYPE]));
                if (desc.objtype == NFT_OBJECT_UNSPEC ||
                    desc.objtype > NFT_OBJECT_MAX)
                        return -EOPNOTSUPP;
        } else if (flags & NFT_SET_OBJECT)
                return -EINVAL;
        else
                desc.objtype = NFT_OBJECT_UNSPEC;

I think it should be possible to simplify this patch: From objref, you
could check if map is of NFT_OBJECT_SYNPROXY type, then check if the
right hook type is used.

Thanks.