Hi,
This patchset adds a new -o/--optimize option to enable ruleset
optimization.
The ruleset optimization first loads the ruleset in "dry run" mode to
validate that the original ruleset is correct. Then, on a second pass it
performs the ruleset optimization before adding the rules into the
kernel.
This infrastructure collects the statements that are used in rules. Then,
it builds a matrix of rules vs. statements. Then, it looks for common
statements in consecutive rules that are candidate to be merged. Finally,
it merges rules.
>From libnftables perspective, there is a new API to enable this feature:
bool nft_ctx_get_optimize(struct nft_ctx *ctx);
void nft_ctx_set_optimize(struct nft_ctx *ctx, bool optimize);
This patchset adds support for three optimizations:
1) Collapse rules matching on a single selector into a set, which
transforms:
ip daddr 192.168.0.1 counter accept
ip daddr 192.168.0.2 counter accept
ip daddr 192.168.0.3 counter accept
into:
ip daddr { 192.168.0.1, 192.168.0.2, 192.168.0.3 } counter packets 0 bytes 0 accept
2) Collapse rules with the same selectors into a concatenation, which
transforms:
meta iifname eth1 ip saddr 1.1.1.1 ip daddr 2.2.2.3 accept
meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.2.5 accept
meta iifname eth2 ip saddr 1.1.1.3 ip daddr 2.2.2.6 accept
into:
meta iifname . ip saddr . ip daddr { eth1 . 1.1.1.1 . 2.2.2.6, eth1 . 1.1.1.2 . 2.2.2.5 , eth1 . 1.1.1.3 . 2.2.2.6 } accept
3) Collapse rules with same selector but different verdic into verdict map,
which transforms:
ct state invalid drop
ct state established,related accept
into:
ct state vmap { established : accept, related : accept, invalid : drop }
Comments welcome,
Thanks.
Pablo Neira Ayuso (3):
src: add ruleset optimization infrastructure
optimize: merge rules with same selectors into a concatenation
optimize: merge same selector with different verdict into verdict map
include/nftables.h | 4 +
include/nftables/libnftables.h | 5 +
src/Makefile.am | 1 +
src/libnftables.c | 41 ++-
src/libnftables.map | 5 +
src/main.c | 9 +-
src/optimize.c | 524 +++++++++++++++++++++++++++++++++
7 files changed, 586 insertions(+), 3 deletions(-)
create mode 100644 src/optimize.c
--
2.30.2
