mirror of
https://git.netfilter.org/nftables
synced 2026-01-26 18:39:03 +00:00
91dc281a82
set_to_intervals() expands range expressions into a list of singleton elements before building the netlink message that is sent to userspace. This is because the kernel expects this list of singleton elements where EXPR_F_INTERVAL_END denotes a closing interval. This expansion significantly increases memory consumption in userspace. This patch updates the logic to transform the range expression up to two temporary singleton element expressions through setelem_to_interval(). Then, these two elements are used to allocate the nftnl_set_elem objects through alloc_nftnl_setelem_interval() to build the netlink message, finally all these temporary objects are released. For anonymous sets, when adjacent ranges are found, the end element is not added to the set to pack the set representation as in the original set_to_intervals() routine. After this update, set_to_intervals() only deals with adding the non-matching all zero element to the interval set when it is not there as the kernel expects. In combination with the new EXPR_RANGE_VALUE expression, this shrinks runtime userspace memory consumption from 70.50 Mbytes to 43.38 Mbytes for a 100k intervals set sample. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
14 lines
596 B
C
14 lines
596 B
C
#ifndef NFTABLES_INTERVALS_H
|
|
#define NFTABLES_INTERVALS_H
|
|
|
|
int set_automerge(struct list_head *msgs, struct cmd *cmd, struct set *set,
|
|
struct expr *init, unsigned int debug_mask);
|
|
int set_delete(struct list_head *msgs, struct cmd *cmd, struct set *set,
|
|
struct expr *init, unsigned int debug_mask);
|
|
int set_overlap(struct list_head *msgs, struct set *set, struct expr *init);
|
|
int set_to_intervals(const struct set *set, struct expr *init, bool add);
|
|
int setelem_to_interval(const struct set *set, struct expr *elem,
|
|
struct expr *next_elem, struct list_head *interval_list);
|
|
|
|
#endif
|