Re: [PATCH nf] netfilter: nf_tables: fix updating/deleting devices in an existing netdev chain

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Mar 10, 2024 at 11:03:40PM +0100, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > Updating netdev basechain is broken in many ways.
> > 
> > Keeping a list of pending hooks to be added/deleted in the transaction
> > object does not mix well with table flag updates (ie. setting dormant
> > flag in table) which operate on the existing basechain hook list.
> > Instead, add/delete hook to/from the basechain hook list and allocate
> > one transaction object per new device to refers to the hook to
> > add/delete.
> > 
> > Add an 'inactive' flag that is set on to identify devices that has been
> > already deleted, so double deletion in one batch is not possible.
> 
> Do you think it makes sense to remove dormant flag support
> for the netdev family?
> 
> It would avoid the register/unregister entanglements and might
> reduce headaches down the road.
> 
> IOW, do you think dormant flag toggling is useful for netdev family?

I would disable it for the netdev family, yes.