[nf-next PATCH 0/2] nf_tables: Export rule optimizer results to user space

[Phil Sutter <phil@nwl.cc>]

While transforming rules into binary blob, code checks if certain
expressions may be omitted. Any bugs in this code might lead to very
subtle breakage of firewall rulesets, so a way of asserting optimizer
correctness is highly necessary.

This series achieves this in the most minimal way by annotating omitted
expressions with a flag. Integrated into libnftnl print output,
testsuites in user space may verify optimizer effect and assert
correctness.

First patch introduces an expression flags attribute, second patch
implements the annotation itself.

Phil Sutter (2):
  netfilter: nf_tables: Introduce expression flags
  netfilter: nf_tables: Annotate reduced expressions

 include/net/netfilter/nf_tables.h        | 3 ++-
 include/uapi/linux/netfilter/nf_tables.h | 8 ++++++++
 net/netfilter/nf_tables_api.c            | 7 ++++++-
 3 files changed, 16 insertions(+), 2 deletions(-)

-- 
2.34.1