Re: [nf-next PATCH v3 06/16] netfilter: nf_tables: Tolerate chains with no remaining hooks

[Phil Sutter <phil@nwl.cc>]

On Thu, Oct 31, 2024 at 03:01:04PM +0100, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > Do not drop a netdev-family chain if the last interface it is registered
> > for vanishes. Users dumping and storing the ruleset upon shutdown for
> > restore upon next boot may otherwise lose the chain and all contained
> > rules. They will still lose the list of devices, a later patch will fix
> > that. For now, this aligns the event handler's behaviour with that for
> > flowtables.
> > The controversal situation at netns exit should be no problem here:
> > event handler will unregister the hooks, core nftables cleanup code will
> > drop the chain itself.
> 
> This "breaks" 
> W: [DUMP FAIL]  1/2 tests/shell/testcases/json/netdev
> W: [DUMP FAIL]  2/2 tests/shell/testcases/chains/netdev_chain_0
> 
> any suggestions on how to handle this?
> 
> We can't fix the dump because old kernel will axe the empty basechain.

AFAIR, we did just that in the past with such cases. I agree, it pretty
much breaks any efforts at making the testsuite usable with stable
kernels.

> Should the dump files be removed?

Maybe "feature flag" it and introduce a mechanism for test cases to
revert to a different dump file?

Or we convince Pablo to axe his efforts at fixing chain deletion in
stable kernels and instead backport my "zombie chain" feature. ;)

Cheers, Phil