Re: [PATCH nf-next] netfilter: nf_tables: remove redundant chain validation on register store

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> This validation predates the introduction of the state machine that
> determines when to enter slow path validation for error reporting.
> 
> Currently, table validation is perform when:
> 
> - new rule contains expressions that need validation.
> - new set element with jump/goto verdict.
> 
> Validation on register store skips most checks with no basechains, still
> this walks the graph searching for loops and ensuring expressions are
> called from the right hook. Remove this.
> 
> Fixes: a654de8fdc18 ("netfilter: nf_tables: fix chain dependency validation")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> Supersedes: ("netfilter: nf_tables: skip register jump/goto validation for non-base chain")
> 
> No rush to apply this, still running a few more tests here on it.

Thanks!  I wonder if this impacts error location reporting.

I agree its not needed from correctness p.o.v. since commit (or abort)
validates entire completed ruleset.