While transforming rules into binary blob, code checks if certain expressions may be omitted. Any bugs in this code might lead to very subtle breakage of firewall rulesets, so a way of asserting optimizer correctness is highly necessary. This series achieves this in the most minimal way by annotating omitted expressions with a flag. Integrated into libnftnl print output, testsuites in user space may verify optimizer effect and assert correctness. First patch introduces an expression flags attribute, second patch implements the annotation itself. Phil Sutter (2): netfilter: nf_tables: Introduce expression flags netfilter: nf_tables: Annotate reduced expressions include/net/netfilter/nf_tables.h | 3 ++- include/uapi/linux/netfilter/nf_tables.h | 8 ++++++++ net/netfilter/nf_tables_api.c | 7 ++++++- 3 files changed, 16 insertions(+), 2 deletions(-) -- 2.34.1
