netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [iptables PATCH v3 00/12] Implement among match support
@ 2019-10-30 17:26 Phil Sutter
  2019-10-30 17:26 ` [iptables PATCH v3 01/12] nft: family_ops: Pass nft_handle to 'add' callback Phil Sutter
                   ` (12 more replies)
  0 siblings, 13 replies; 21+ messages in thread
From: Phil Sutter @ 2019-10-30 17:26 UTC (permalink / raw)
  To: Pablo Neira Ayuso; +Cc: netfilter-devel

Changes since v2:
- Rebased onto current master branch. With cache levels being upstream,
  no dependencies on unfinished work remains.
- Integrate sets caching into cache level infrastructure.
- Fixed temporary build breakage within series.
- Larger review of last patch containing the actual among match
  extension.

Changes since v1:
- Rebased onto my performance improvements patch series.
- Aligned set caching routines with changes in above series.
- Fixed patch ordering so builds are not broken intermittently.
- Replaced magic numbers by defines or offsetof() statements. Note that
  I did not move any defines into libnftnl; the remaining ones are for
  values in sets' key_type attribute which neither libnftnl nor kernel
  care about. Setting that is merely for compatibility with nft tool.

This series ultimately adds among match support to ebtables-nft. The
implementation merely shares the user interface with legacy one,
internally the code is distinct: libebt_among.c does not make use of the
wormhash data structure but a much simpler one for "temporary" storage
of data until being converted into an anonymous set and associated
lookup expression.

Patches 1 to 5 implement required changes and are rather boring by
themselves: When converting an nftnl rule to iptables command state,
cache access is required (to lookup set references).

Patch 6 simplifies things a bit with the above in place.

Patches 7 to 11 implement anonymous set support.

Patch 12 then adds the actual among match implementation for
ebtables-nft.

Phil Sutter (12):
  nft: family_ops: Pass nft_handle to 'add' callback
  nft: family_ops: Pass nft_handle to 'rule_find' callback
  nft: family_ops: Pass nft_handle to 'print_rule' callback
  nft: family_ops: Pass nft_handle to 'rule_to_cs' callback
  nft: Keep nft_handle pointer in nft_xt_ctx
  nft: Eliminate pointless calls to nft_family_ops_lookup()
  nft: Introduce NFT_CL_SETS cache level
  nft: Support NFT_COMPAT_SET_ADD
  nft: Bore up nft_parse_payload()
  nft: Embed rule's table name in nft_xt_ctx
  nft: Support parsing lookup expression
  nft: bridge: Rudimental among extension support

 extensions/libebt_among.c  | 243 +++++++++++++++++++++++++++++++++
 extensions/libebt_among.t  |  16 +++
 iptables/ebtables-nft.8    |  66 ++++-----
 iptables/nft-arp.c         |  13 +-
 iptables/nft-bridge.c      | 232 ++++++++++++++++++++++++++++++--
 iptables/nft-bridge.h      |  56 ++++++++
 iptables/nft-cache.c       | 205 ++++++++++++++++++++++++++--
 iptables/nft-cache.h       |   2 +
 iptables/nft-ipv4.c        |  10 +-
 iptables/nft-ipv6.c        |  10 +-
 iptables/nft-shared.c      |  70 +++++-----
 iptables/nft-shared.h      |  26 ++--
 iptables/nft.c             | 269 ++++++++++++++++++++++++++++++++-----
 iptables/nft.h             |   8 +-
 iptables/xtables-eb.c      |   1 +
 iptables/xtables-monitor.c |  17 ++-
 iptables/xtables-save.c    |   3 +
 17 files changed, 1101 insertions(+), 146 deletions(-)
 create mode 100644 extensions/libebt_among.c
 create mode 100644 extensions/libebt_among.t

-- 
2.23.0


^ permalink raw reply	[flat|nested] 21+ messages in thread

end of thread, other threads:[~2019-10-31 15:01 UTC | newest]

Thread overview: 21+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-30 17:26 [iptables PATCH v3 00/12] Implement among match support Phil Sutter
2019-10-30 17:26 ` [iptables PATCH v3 01/12] nft: family_ops: Pass nft_handle to 'add' callback Phil Sutter
2019-10-31 14:05   ` Pablo Neira Ayuso
2019-10-30 17:26 ` [iptables PATCH v3 02/12] nft: family_ops: Pass nft_handle to 'rule_find' callback Phil Sutter
2019-10-31 14:05   ` Pablo Neira Ayuso
2019-10-30 17:26 ` [iptables PATCH v3 03/12] nft: family_ops: Pass nft_handle to 'print_rule' callback Phil Sutter
2019-10-31 14:05   ` Pablo Neira Ayuso
2019-10-30 17:26 ` [iptables PATCH v3 04/12] nft: family_ops: Pass nft_handle to 'rule_to_cs' callback Phil Sutter
2019-10-30 17:26 ` [iptables PATCH v3 05/12] nft: Keep nft_handle pointer in nft_xt_ctx Phil Sutter
2019-10-30 17:26 ` [iptables PATCH v3 06/12] nft: Eliminate pointless calls to nft_family_ops_lookup() Phil Sutter
2019-10-30 17:26 ` [iptables PATCH v3 07/12] nft: Introduce NFT_CL_SETS cache level Phil Sutter
2019-10-31 14:04   ` Pablo Neira Ayuso
2019-10-31 14:08     ` Phil Sutter
2019-10-30 17:26 ` [iptables PATCH v3 08/12] nft: Support NFT_COMPAT_SET_ADD Phil Sutter
2019-10-30 17:26 ` [iptables PATCH v3 09/12] nft: Bore up nft_parse_payload() Phil Sutter
2019-10-30 17:26 ` [iptables PATCH v3 10/12] nft: Embed rule's table name in nft_xt_ctx Phil Sutter
2019-10-30 17:27 ` [iptables PATCH v3 11/12] nft: Support parsing lookup expression Phil Sutter
2019-10-30 17:27 ` [iptables PATCH v3 12/12] nft: bridge: Rudimental among extension support Phil Sutter
2019-10-31 14:13 ` [iptables PATCH v3 00/12] Implement among match support Pablo Neira Ayuso
2019-10-31 14:14   ` Pablo Neira Ayuso
2019-10-31 15:01     ` Phil Sutter

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).