Linux Netfilter development
 help / color / mirror / Atom feed
* [PATCH nft] json: collapse set element commands from parser
@ 2024-10-31 22:04 Pablo Neira Ayuso
  2024-11-01 14:55 ` Eric Garver
                   ` (2 more replies)
  0 siblings, 3 replies; 11+ messages in thread
From: Pablo Neira Ayuso @ 2024-10-31 22:04 UTC (permalink / raw)
  To: netfilter-devel; +Cc: phil, eric

Update json parser to collapse {add,create} element commands to reduce
memory consumption in the case of large sets defined by one element per
command:

{"nftables": [{"add": {"element": {"family": "ip", "table": "x", "name":
"y", "elem": [{"set": ["1.1.0.0"]}]}}},...]}

Add CTX_F_COLLAPSED flag to report that command has been collapsed.

This patch reduces memory consumption by ~32% this case.

Fixes: 20f1c60ac8c8 ("src: collapse set element commands from parser")
Reported-by: Eric Garver <eric@garver.life>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
Side note: While profiling, I can still see lots json objects, this
results in memory consumption that is 5 times than native
representation. Error reporting is also lagging behind, it should be
possible to add a json_t pointer to struct location to relate
expressions and json objects.

 src/parser_json.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/parser_json.c b/src/parser_json.c
index 37ec34cb7796..68c0600df085 100644
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -18,6 +18,7 @@
 #include <netlink.h>
 #include <parser.h>
 #include <rule.h>
+#include <cmd.h>
 #include <sctp_chunk.h>
 #include <socket.h>
 
@@ -49,6 +50,7 @@
 #define CTX_F_SES	(1 << 6)	/* set_elem_expr_stmt */
 #define CTX_F_MAP	(1 << 7)	/* LHS of map_expr */
 #define CTX_F_CONCAT	(1 << 8)	/* inside concat_expr */
+#define CTX_F_COLLAPSED	(1 << 9)
 
 struct json_ctx {
 	struct nft_ctx *nft;
@@ -3490,6 +3492,15 @@ static struct cmd *json_parse_cmd_add_element(struct json_ctx *ctx,
 		handle_free(&h);
 		return NULL;
 	}
+
+	if ((op == CMD_CREATE || op == CMD_ADD) &&
+	    nft_cmd_collapse_elems(op, ctx->cmds, &h, expr)) {
+		handle_free(&h);
+		expr_free(expr);
+		ctx->flags |= CTX_F_COLLAPSED;
+		return NULL;
+	}
+
 	return cmd_alloc(op, cmd_obj, &h, int_loc, expr);
 }
 
@@ -4319,6 +4330,11 @@ static int __json_parse(struct json_ctx *ctx)
 		cmd = json_parse_cmd(ctx, value);
 
 		if (!cmd) {
+			if (ctx->flags & CTX_F_COLLAPSED) {
+				ctx->flags &= ~CTX_F_COLLAPSED;
+				continue;
+			}
+
 			json_error(ctx, "Parsing command array at index %zd failed.", index);
 			return -1;
 		}
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 11+ messages in thread
end of thread, other threads:[~2024-11-13 14:35 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-10-31 22:04 [PATCH nft] json: collapse set element commands from parser Pablo Neira Ayuso
2024-11-01 14:55 ` Eric Garver
2024-11-05 13:35 ` Phil Sutter
2024-11-05 16:51   ` Pablo Neira Ayuso
2024-11-05 17:07     ` Phil Sutter
2024-11-13 11:08       ` improving json error reporting [was Re: [PATCH nft] json: collapse set element commands from parser] Pablo Neira Ayuso
2024-11-13 14:18         ` Phil Sutter
2024-11-12 20:52 ` [PATCH nft] json: collapse set element commands from parser Phil Sutter
2024-11-13 11:01   ` Pablo Neira Ayuso
2024-11-13 11:34     ` Pablo Neira Ayuso
2024-11-13 14:35     ` Phil Sutter

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox