[PATCH nft 0/7] named sets with intervals

[Pablo Neira Ayuso <pablo@netfilter.org>]

This patchset updates the set interval support to work with named sets,
that requires the following kernel patches that I have already submitted:

http://patchwork.ozlabs.org/patch/609733/
http://patchwork.ozlabs.org/patch/609734/
http://patchwork.ozlabs.org/patch/609735/
http://patchwork.ozlabs.org/patch/609736/

Several comments on this:

1) nft supports automerging of adjacent intervals when they are added in
   the same command, eg.

	nft add element filter myset { 192.168.0.0/24, 192.168.1.0/24 }

   this results in one single interval 192.168.0.0/23.

   However, if you add them in two command invocations:

	nft add element filter myset { 192.168.0.0/24 }
	nft add element filter myset { 192.168.0.1/24 }

   You get two intervals, ie. 192.168.0.0/24 and 192.168.1.0/24. Automerging
   for this case should be possible from userspace, by removing the previous
   interval and adding the new one. This code is not yet available though.

2) There is currently no check in userspace for interval shadowing, eg.

	nft add element filter myset { 192.168.0.0/24 }
	nft add element filter myset { 192.168.0.0/16 }

    In this case, the largest segment is prioritized over the smaller one.
    The code to detect this shadowing from userspace is missing.

3) The first non-matching end interval (ie. all-zero) is specific of the
   rbtree implementation, I don't need this in my bitmap set
   representation. This is already part of the API though, so my plan is to
   add this node to the rbtree set from the kernel and ignore whenever we
   receive it from userspace, so we can deprecate having to send this from
   userspace at some point.

4) Support for named interval map is also missing. This requires a very
   small oneliner fix for the parser. Interval shadowing is particularly
   problematic in this scenario, for this reason, the oneliner fix should
   come with the shadowing detection code too. Meanwhile we don't have
   proper support for named interval maps.

Pablo Neira Ayuso (7):
  segtree: perform stricter expression type validation from expr_value()
  segtree: clone full expression from interval_map_decompose()
  segtree: handle adjacent interval nodes from expr_value_cmp()
  segtree: explicit initialization via set_to_intervals()
  rule: support for incremental set interval element updates
  segtree: special handling for the first non-matching segment
  evaluate: bail out on prefix or range to non-interval set

 include/expression.h |  3 ++-
 src/evaluate.c       | 15 +++++++++++
 src/rule.c           | 52 +++++++++++++++++++++++++++++-------
 src/segtree.c        | 75 +++++++++++++++++++++++++++++++++++++++++-----------
 4 files changed, 118 insertions(+), 27 deletions(-)

-- 
2.1.4