Re: [PATCH nf] netfilter: nft_compat: run checkentry() from .validate

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Apr 20, 2026 at 08:21:18PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Mon, Apr 20, 2026 at 07:55:22PM +0200, Florian Westphal wrote:
> > > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > > Several matches and one target check that the hook is correct from
> > > > checkentry(), however, the basechain is only available from
> > > > nft_table_validate().
> > > > 
> > > > This patch calls checkentry() for matches and targets from the
> > > > nft_compat expression .validate path for the following matches/target:
> > > 
> > > I worry that this is fragile.  Not all ->checkentry callbacks are pure.
> > > Some create /proc entries or bump reference counts.
> > 
> > xt_set does bump the reference count. This calls xt.destroy to restore it.
> > I am only calling them for the list of expression you mentioned.
> 
> I worry this will lead to trouble later, e.g. info->priv = kmalloc( ...)
> -> memory leak.

If someone needs to cover for more extensions, they will have to
update the list of extensions covered by the strcmp() check on the
extension name.

> But OK, at least there is a test case in iptables.git for this.

Yes.

Your approach duplicates .checkentry in some way, you have to make
sure what your .validate and .checkentry perform the same check, ie.
they are in sync.

The approach proposed in this patch is not universal, because
checkentry() is a place where many things happen as you suggested
(/proc entries being registered, reference count being bumped,i
kmalloc...).

If this needs to be generalized further, maybe checkentry() needs to
extended to improve integration with nftables.