From: Florian Westphal <fw@strlen.de>
To: <netfilter-devel@vger.kernel.org>
Cc: Florian Westphal <fw@strlen.de>
Subject: [PATCH nft 0/6] nftables: add --optimize support
Date: Thu, 27 May 2021 17:43:17 +0200 [thread overview]
Message-ID: <20210527154323.4003-1-fw@strlen.de> (raw)
This adds a new option, -O/--optimize, to enable/disable ruleset
transformations.
First two supported optimizations are:
1. Allow removal of implicit dependencies on 'list ruleset'.
2. Allow automatic replacement of anonymous sets with only one
element.
There is currently no exported libnftables function to provide
access to the internal settings.
If there is a use case it can be added later on.
Florian Westphal (6):
src: add proto ctx options
src: allow to turn off dependency removal
main: add -O help to dump list of supported optimzation flags
evaluate: optionally kill anon sets with one element
tests: add test case for -O no-remove-dependencies
tests: add test case for removal of anon sets with only a single
element
include/nftables.h | 12 +++
include/proto.h | 10 +-
include/rule.h | 6 ++
src/evaluate.c | 25 ++++-
src/libnftables.c | 10 ++
src/main.c | 100 ++++++++++++++++++
src/netlink.c | 2 +-
src/netlink_delinearize.c | 16 ++-
src/proto.c | 4 +-
.../optimizations/dumps/payload_meta_deps.nft | 10 ++
.../dumps/payload_meta_deps.no-remove-deps | 10 ++
.../optimizations/dumps/single_anon_set.nft | 12 +++
.../single_anon_set.replace-single-anon-sets | 12 +++
.../testcases/optimizations/payload_meta_deps | 33 ++++++
.../testcases/optimizations/single_anon_set | 30 ++++++
15 files changed, 282 insertions(+), 10 deletions(-)
create mode 100644 tests/shell/testcases/optimizations/dumps/payload_meta_deps.nft
create mode 100644 tests/shell/testcases/optimizations/dumps/payload_meta_deps.no-remove-deps
create mode 100644 tests/shell/testcases/optimizations/dumps/single_anon_set.nft
create mode 100644 tests/shell/testcases/optimizations/dumps/single_anon_set.replace-single-anon-sets
create mode 100755 tests/shell/testcases/optimizations/payload_meta_deps
create mode 100755 tests/shell/testcases/optimizations/single_anon_set
--
2.26.3
next reply other threads:[~2021-05-27 15:43 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-27 15:43 Florian Westphal [this message]
2021-05-27 15:43 ` [PATCH nft 1/6] src: add proto ctx options Florian Westphal
2021-05-27 15:43 ` [PATCH nft 2/6] src: allow to turn off dependency removal Florian Westphal
2021-05-27 15:43 ` [PATCH nft 3/6] main: add -O help to dump list of supported optimzation flags Florian Westphal
2021-05-27 15:43 ` [PATCH nft 4/6] evaluate: optionally kill anon sets with one element Florian Westphal
2021-05-27 15:43 ` [PATCH nft 5/6] tests: add test case for -O no-remove-dependencies Florian Westphal
2021-05-27 15:43 ` [PATCH nft 6/6] tests: add test case for removal of anon sets with only a single element Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210527154323.4003-1-fw@strlen.de \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).