[PATCH nft 0/4] split parse and evaluation phase to simplify cache logic

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

There are a myriad of cache_update() calls all over the evaluation phase
that are required because the parser invokes the evaluation per command.

This complicates the cache logic, since nft may have to invalid a
partial cache to upgrade to a full cache from one command to another.
This forces nft to go back re-evaluate the existing batch that is being
processed, this overly complicates things because the number of
scenarios that trigger cache updates explode. This will get even more
complicated once we do proper cache generation and ERESTART support is
added - which is still missing.

This patchset aims to simplify cache logic by performing one single
cache_update() before the evaluation phase, the idea is to iterate over
the existing commands that come from the parser to do a cache_evaluate()
call that calculates what cache nft needs to dump from the kernel
(either partial or full, actually we have more degress of completeness,
not just these two only). Then, with the proper cache in place, the
evaluation happens.

This patchset revisits the existing design to address this problem:

1) Dynamically allocate input_descriptor object, this allows error
   reporting from the evaluation phase to access file location that
   was only available from the parser phase.

2) Evaluate the ruleset once the parser is complete. So we have two
   independent phases.

3) The mixture of parsing + evaluation was introduced to display all
   errors, either from the parsing or the evaluation phases.

4) Make a single cache_update() call based on the new cache_evaluate()
   function that calculates the kernel dump that needs to be done
   before entering the evaluation phase.

Thanks.

Pablo Neira Ayuso (4):
  src: dynamic input_descriptor allocation
  src: perform evaluation after parsing
  src: Display parser and evaluate errors in one shot
  src: single cache_update() call to build cache before evaluation

 include/nftables.h |   1 +
 include/parser.h   |   4 +-
 include/rule.h     |   1 +
 src/Makefile.am    |   1 +
 src/cache.c        | 123 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 src/erec.c         |  35 +--------------
 src/evaluate.c     |  76 +--------------------------------
 src/libnftables.c  |  57 +++++++++++++++++++------
 src/mnl.c          |   8 +---
 src/parser_bison.y |  28 ++----------
 src/parser_json.c  |   9 ----
 src/rule.c         |  18 +-------
 src/scanner.l      |  63 ++++++++++++++++++---------
 13 files changed, 222 insertions(+), 202 deletions(-)
 create mode 100644 src/cache.c

-- 
2.11.0