Re: [PATCH nf,v2] netfilter: nftables: accept all dummy chain when table is dormant

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, May 19, 2021 at 08:34:04PM +0200, Florian Westphal wrote:
> > ... but that is doable in the sense that unregister can't fail.
> 
> Right, but adding "unregister hooks" to the abort path breaks a
> different scenario. This might unregister a hook that, because of a later
> wake-up action, needs to stay there, because you cannot call register
> a hook from the abort path, it's a bit of a whac-a-mole game.

Argh, indeed.  We'd have to re-scan the transaction log during
preparation phase for each dormant on/off and chain add/delete to
see if the action un-does an earlier pending one, then remove both
if they cancel each other.

> > I guess dormat tables are an exception and not the norm, so maybe
> > unfounded concern.
> 
> You are right that this approach incurs in the hook evaluation penalty
> from the packet path. But I don't think there's a need to optimize
> this feature at this stage

Ok, I dislike optimizing too early as well.

> So I'm just inclined to keep it simple while making sure that any
> possible (silly) robot-generated sequence with this toggle works fine.

Ok, lets use your approach then.