From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 31 Oct 2024 20:38:02 +0000 (+0100)
Subject: json: collapse set element commands from parser
X-Git-Tag: v1.1.2~126
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=193faa5475a5df7d9ac0b1a8fe647196de3e5688;p=thirdparty%2Fnftables.git

json: collapse set element commands from parser

Update json parser to collapse {add,create} element commands to reduce
memory consumption in the case of large sets defined by one element per
command:

{"nftables": [{"add": {"element": {"family": "ip", "table": "x", "name":
"y", "elem": [{"set": ["1.1.0.0"]}]}}},...]}

Add CTX_F_COLLAPSED flag to report that command has been collapsed.

This patch reduces memory consumption by ~32% this case.

Fixes: 20f1c60ac8c8 ("src: collapse set element commands from parser")
Reported-by: Eric Garver <eric@garver.life>
Tested-by: Eric Garver <eric@garver.life>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/src/parser_json.c b/src/parser_json.c
index 37ec34cb..68c0600d 100644
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -18,6 +18,7 @@
 #include <netlink.h>
 #include <parser.h>
 #include <rule.h>
+#include <cmd.h>
 #include <sctp_chunk.h>
 #include <socket.h>
 
@@ -49,6 +50,7 @@
 #define CTX_F_SES	(1 << 6)	/* set_elem_expr_stmt */
 #define CTX_F_MAP	(1 << 7)	/* LHS of map_expr */
 #define CTX_F_CONCAT	(1 << 8)	/* inside concat_expr */
+#define CTX_F_COLLAPSED	(1 << 9)
 
 struct json_ctx {
 	struct nft_ctx *nft;
@@ -3490,6 +3492,15 @@ static struct cmd *json_parse_cmd_add_element(struct json_ctx *ctx,
 		handle_free(&h);
 		return NULL;
 	}
+
+	if ((op == CMD_CREATE || op == CMD_ADD) &&
+	    nft_cmd_collapse_elems(op, ctx->cmds, &h, expr)) {
+		handle_free(&h);
+		expr_free(expr);
+		ctx->flags |= CTX_F_COLLAPSED;
+		return NULL;
+	}
+
 	return cmd_alloc(op, cmd_obj, &h, int_loc, expr);
 }
 
@@ -4319,6 +4330,11 @@ static int __json_parse(struct json_ctx *ctx)
 		cmd = json_parse_cmd(ctx, value);
 
 		if (!cmd) {
+			if (ctx->flags & CTX_F_COLLAPSED) {
+				ctx->flags &= ~CTX_F_COLLAPSED;
+				continue;
+			}
+
 			json_error(ctx, "Parsing command array at index %zd failed.", index);
 			return -1;
 		}