[nf-next PATCH v3 0/4] nf_tables: Export rule optimizer results to user space

[Phil Sutter <phil@nwl.cc>]

Changes since v2:
- New patches 1 and 2

Changes since v1:
- Fixed two bugs in patch 2.

While transforming rules into binary blob, code checks if certain
expressions may be omitted. Any bugs in this code might lead to very
subtle breakage of firewall rulesets, so a way of asserting optimizer
correctness is highly necessary.

This series achieves this in the most minimal way by annotating omitted
expressions with a flag. Integrated into libnftnl print output,
testsuites in user space may verify optimizer effect and assert
correctness.

First patch prepares for a blob-specific variant of struct nft_expr
which is smaller than the original. Second patch introduces this
variant. Third patch extends structy nft_expr by a new field and finally
fourth patch populates it.

Phil Sutter (4):
  netfilter: nf_tables: Store net size in nft_expr_ops::size
  netfilter: nf_tables: Introduce struct nft_expr_dp
  netfilter: nf_tables: Introduce expression flags
  netfilter: nf_tables: Annotate reduced expressions

 include/net/netfilter/nf_tables.h        | 13 ++++++--
 include/uapi/linux/netfilter/nf_tables.h |  8 +++++
 net/netfilter/nf_tables_api.c            | 42 ++++++++++++++++--------
 3 files changed, 48 insertions(+), 15 deletions(-)

-- 
2.34.1