|
 |
8cce6c |
From 062f97fdd10d0930fecbbf49438ff856ea46ca9e Mon Sep 17 00:00:00 2001
|
|
|
8cce6c |
From: Phil Sutter <phil@nwl.cc>
|
|
|
8cce6c |
Date: Thu, 20 Dec 2018 16:09:20 +0100
|
|
|
8cce6c |
Subject: [PATCH] nft: Make use of nftnl_rule_lookup_byindex()
|
|
|
8cce6c |
|
|
|
8cce6c |
Use the function where suitable to potentially speedup rule cache lookup
|
|
|
8cce6c |
by rule number.
|
|
|
8cce6c |
|
|
|
8cce6c |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
8cce6c |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
8cce6c |
(cherry picked from commit 039b04896521026d1cb52d60dbacb6ee5226c02d)
|
|
|
8cce6c |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
8cce6c |
---
|
|
|
8cce6c |
iptables/nft.c | 31 ++++++++++++++++++-------------
|
|
|
8cce6c |
1 file changed, 18 insertions(+), 13 deletions(-)
|
|
|
8cce6c |
|
|
|
8cce6c |
diff --git a/iptables/nft.c b/iptables/nft.c
|
|
|
8cce6c |
index e0455eabda77a..1fd3837f2d334 100644
|
|
|
8cce6c |
--- a/iptables/nft.c
|
|
|
8cce6c |
+++ b/iptables/nft.c
|
|
|
8cce6c |
@@ -1976,27 +1976,21 @@ nft_rule_find(struct nft_handle *h, struct nftnl_chain *c, void *data, int rulen
|
|
|
8cce6c |
{
|
|
|
8cce6c |
struct nftnl_rule *r;
|
|
|
8cce6c |
struct nftnl_rule_iter *iter;
|
|
|
8cce6c |
- int rule_ctr = 0;
|
|
|
8cce6c |
bool found = false;
|
|
|
8cce6c |
|
|
|
8cce6c |
+ if (rulenum >= 0)
|
|
|
8cce6c |
+ /* Delete by rule number case */
|
|
|
8cce6c |
+ return nftnl_rule_lookup_byindex(c, rulenum);
|
|
|
8cce6c |
+
|
|
|
8cce6c |
iter = nftnl_rule_iter_create(c);
|
|
|
8cce6c |
if (iter == NULL)
|
|
|
8cce6c |
return 0;
|
|
|
8cce6c |
|
|
|
8cce6c |
r = nftnl_rule_iter_next(iter);
|
|
|
8cce6c |
while (r != NULL) {
|
|
|
8cce6c |
- if (rulenum >= 0) {
|
|
|
8cce6c |
- /* Delete by rule number case */
|
|
|
8cce6c |
- if (rule_ctr == rulenum) {
|
|
|
8cce6c |
- found = true;
|
|
|
8cce6c |
- break;
|
|
|
8cce6c |
- }
|
|
|
8cce6c |
- } else {
|
|
|
8cce6c |
- found = h->ops->rule_find(h->ops, r, data);
|
|
|
8cce6c |
- if (found)
|
|
|
8cce6c |
- break;
|
|
|
8cce6c |
- }
|
|
|
8cce6c |
- rule_ctr++;
|
|
|
8cce6c |
+ found = h->ops->rule_find(h->ops, r, data);
|
|
|
8cce6c |
+ if (found)
|
|
|
8cce6c |
+ break;
|
|
|
8cce6c |
r = nftnl_rule_iter_next(iter);
|
|
|
8cce6c |
}
|
|
|
8cce6c |
|
|
|
8cce6c |
@@ -2202,6 +2196,17 @@ __nft_rule_list(struct nft_handle *h, struct nftnl_chain *c,
|
|
|
8cce6c |
struct nftnl_rule *r;
|
|
|
8cce6c |
int rule_ctr = 0;
|
|
|
8cce6c |
|
|
|
8cce6c |
+ if (rulenum > 0) {
|
|
|
8cce6c |
+ r = nftnl_rule_lookup_byindex(c, rulenum - 1);
|
|
|
8cce6c |
+ if (!r)
|
|
|
8cce6c |
+ /* iptables-legacy returns 0 when listing for
|
|
|
8cce6c |
+ * valid chain but invalid rule number
|
|
|
8cce6c |
+ */
|
|
|
8cce6c |
+ return 1;
|
|
|
8cce6c |
+ cb(r, rulenum, format);
|
|
|
8cce6c |
+ return 1;
|
|
|
8cce6c |
+ }
|
|
|
8cce6c |
+
|
|
|
8cce6c |
iter = nftnl_rule_iter_create(c);
|
|
|
8cce6c |
if (iter == NULL)
|
|
|
8cce6c |
return 0;
|
|
|
8cce6c |
--
|
|
|
8cce6c |
2.20.1
|
|
|
8cce6c |
|