Changes since v2: - New patches 1 and 2 Changes since v1: - Fixed two bugs in patch 2. While transforming rules into binary blob, code checks if certain expressions may be omitted. Any bugs in this code might lead to very subtle breakage of firewall rulesets, so a way of asserting optimizer correctness is highly necessary. This series achieves this in the most minimal way by annotating omitted expressions with a flag. Integrated into libnftnl print output, testsuites in user space may verify optimizer effect and assert correctness. First patch prepares for a blob-specific variant of struct nft_expr which is smaller than the original. Second patch introduces this variant. Third patch extends structy nft_expr by a new field and finally fourth patch populates it. Phil Sutter (4): netfilter: nf_tables: Store net size in nft_expr_ops::size netfilter: nf_tables: Introduce struct nft_expr_dp netfilter: nf_tables: Introduce expression flags netfilter: nf_tables: Annotate reduced expressions include/net/netfilter/nf_tables.h | 13 ++++++-- include/uapi/linux/netfilter/nf_tables.h | 8 +++++ net/netfilter/nf_tables_api.c | 42 ++++++++++++++++-------- 3 files changed, 48 insertions(+), 15 deletions(-) -- 2.34.1
