Re: [PATCH nf-next 1/2] netfilter: nf_tables: skip register jump/goto validation for non-base chain

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Nov 19, 2025 at 01:04:23AM +0100, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > Validating a non-base chain for each register store slows down
> > validation unnecessarily, remove it.
> > 
> > Fixes: a654de8fdc18 ("netfilter: nf_tables: fix chain dependency validation")
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> >  net/netfilter/nf_tables_api.c | 3 +++
> >  1 file changed, 3 insertions(+)
> > 
> > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> > index 6f35f0b7a33c..bef95cede7b5 100644
> > --- a/net/netfilter/nf_tables_api.c
> > +++ b/net/netfilter/nf_tables_api.c
> > @@ -11846,6 +11846,9 @@ static int nft_validate_register_store(const struct nft_ctx *ctx,
> >  		if (data != NULL &&
> >  		    (data->verdict.code == NFT_GOTO ||
> >  		     data->verdict.code == NFT_JUMP)) {
> > +			if (!nft_is_base_chain(ctx->chain))
> > +				break;
> > +
> 
> This is confusing.  ctx->chain? data->verdict.chain?

ctx->chain is the current chain for this new rule.

data->verdict.chain is the destination chain.

> Wouldn't it make more sense to elide the check if we have
> ctx->table->validate_state != NFT_VALIDATE_DO ?

I am sure we have to skip non-basechains in this case, it makes us
walk the graph for no reason, even with NFT_VALIDATE_DO.

Let me have a second look, thanks for reviewing.