mbox series

[nf-next,v4,0/4] nf_tables: Export rule optimizer results to user space

Message ID 20220517172050.32653-1-phil@nwl.cc
Headers show
Series nf_tables: Export rule optimizer results to user space | expand

Message

Phil Sutter May 17, 2022, 5:20 p.m. UTC 
Changes since v3:
- Add missing chunks to patch 1

Changes since v2:
- New patches 1 and 2

Changes since v1:
- Fixed two bugs in patch 2.

While transforming rules into binary blob, code checks if certain
expressions may be omitted. Any bugs in this code might lead to very
subtle breakage of firewall rulesets, so a way of asserting optimizer
correctness is highly necessary.

This series achieves this in the most minimal way by annotating omitted
expressions with a flag. Integrated into libnftnl print output,
testsuites in user space may verify optimizer effect and assert
correctness.

First patch prepares for a blob-specific variant of struct nft_expr
which is smaller than the original. Second patch introduces this
variant. Third patch extends struct nft_expr by a new field and finally
fourth patch populates it.

Phil Sutter (4):
  netfilter: nf_tables: Store net size in nft_expr_ops::size
  netfilter: nf_tables: Introduce struct nft_expr_dp
  netfilter: nf_tables: Introduce expression flags
  netfilter: nf_tables: Annotate reduced expressions

 include/net/netfilter/nf_tables.h        | 18 +++++++---
 include/uapi/linux/netfilter/nf_tables.h |  8 +++++
 net/netfilter/nf_tables_api.c            | 42 ++++++++++++++++--------
 3 files changed, 51 insertions(+), 17 deletions(-)

Comments

Phil Sutter May 25, 2022, 1:11 p.m. UTC | #1 
Hi,

Please scratch this series, it does not work at all. I missed the point
that all expression eval callbacks expect a regular nft_expr object,
this series therefore leads to memory corruption at run-time.

Sorry, Phil