summaryrefslogtreecommitdiffstats
path: root/src/libnftables.c
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2019-06-05 17:07:42 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2019-06-05 17:54:50 +0200
commitf211921e25e683eb0cbfac08fd0289a07b6d67d1 (patch)
treeaa8f8e60a97d152a6abee8483afd48cace4d98a1 /src/libnftables.c
parent60e917fa7cb55b4f675110bae78df56cd49bd486 (diff)
src: perform evaluation after parsing
Since 61236968b7a1 ("parser: evaluate commands immediately after parsing"), evaluation is invoked from the parsing phase in order to improve error reporting. However, this approach is problematic from the cache perspective since we don't know if a full or partial netlink dump from the kernel is needed. If the number of objects in the kernel is significant, the netlink dump operation to build the cache may significantly slow down commands. This patch moves the evaluation phase after the parsing phase as a preparation update to allow for a better strategy to build the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/libnftables.c')
-rw-r--r--src/libnftables.c30
1 files changed, 25 insertions, 5 deletions
diff --git a/src/libnftables.c b/src/libnftables.c
index d8de89ca..8720fe2b 100644
--- a/src/libnftables.c
+++ b/src/libnftables.c
@@ -348,7 +348,6 @@ static const struct input_descriptor indesc_cmdline = {
static int nft_parse_bison_buffer(struct nft_ctx *nft, const char *buf,
struct list_head *msgs, struct list_head *cmds)
{
- struct cmd *cmd;
int ret;
parser_init(nft, nft->state, msgs, cmds);
@@ -359,16 +358,12 @@ static int nft_parse_bison_buffer(struct nft_ctx *nft, const char *buf,
if (ret != 0 || nft->state->nerrs > 0)
return -1;
- list_for_each_entry(cmd, cmds, list)
- nft_cmd_expand(cmd);
-
return 0;
}
static int nft_parse_bison_filename(struct nft_ctx *nft, const char *filename,
struct list_head *msgs, struct list_head *cmds)
{
- struct cmd *cmd;
int ret;
parser_init(nft, nft->state, msgs, cmds);
@@ -380,6 +375,23 @@ static int nft_parse_bison_filename(struct nft_ctx *nft, const char *filename,
if (ret != 0 || nft->state->nerrs > 0)
return -1;
+ return 0;
+}
+
+static int nft_evaluate(struct nft_ctx *nft, struct list_head *msgs,
+ struct list_head *cmds)
+{
+ struct cmd *cmd;
+
+ list_for_each_entry(cmd, cmds, list) {
+ struct eval_ctx ectx = {
+ .nft = nft,
+ .msgs = msgs,
+ };
+ if (cmd_evaluate(&ectx, cmd) < 0)
+ return -1;
+ }
+
list_for_each_entry(cmd, cmds, list)
nft_cmd_expand(cmd);
@@ -404,6 +416,10 @@ int nft_run_cmd_from_buffer(struct nft_ctx *nft, const char *buf)
if (rc)
goto err;
+ rc = nft_evaluate(nft, &msgs, &cmds);
+ if (rc < 0)
+ goto err;
+
if (nft_netlink(nft, &cmds, &msgs, nft->nf_sock) != 0)
rc = -1;
err:
@@ -448,6 +464,10 @@ int nft_run_cmd_from_filename(struct nft_ctx *nft, const char *filename)
if (rc)
goto err;
+ rc = nft_evaluate(nft, &msgs, &cmds);
+ if (rc < 0)
+ goto err;
+
if (nft_netlink(nft, &cmds, &msgs, nft->nf_sock) != 0)
rc = -1;
err: