|
 |
029dc7 |
From 27bc424993e8138e26d7db1d7f902baaf269dd7c Mon Sep 17 00:00:00 2001
|
|
|
029dc7 |
From: Phil Sutter <phil@nwl.cc>
|
|
|
029dc7 |
Date: Wed, 12 Dec 2018 20:04:12 +0100
|
|
|
029dc7 |
Subject: [PATCH] xtables: Speed up chain deletion in large rulesets
|
|
|
029dc7 |
|
|
|
029dc7 |
Kernel prefers to identify chain by handle if it was given which causes
|
|
|
029dc7 |
manual traversal of the chain list. In contrast, chain lookup by name in
|
|
|
029dc7 |
kernel makes use of a hash table so is considerably faster. Force this
|
|
|
029dc7 |
code path by removing the cached chain's handle when removing it.
|
|
|
029dc7 |
|
|
|
029dc7 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
029dc7 |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
029dc7 |
(cherry picked from commit a5f517a41d72794fae3d1332e6e0e413a5cd16c1)
|
|
|
029dc7 |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
029dc7 |
---
|
|
|
029dc7 |
iptables/nft.c | 2 ++
|
|
|
029dc7 |
1 file changed, 2 insertions(+)
|
|
|
029dc7 |
|
|
|
029dc7 |
diff --git a/iptables/nft.c b/iptables/nft.c
|
|
|
029dc7 |
index 1ce1ecdd276be..9c0ad9a2d054f 100644
|
|
|
029dc7 |
--- a/iptables/nft.c
|
|
|
029dc7 |
+++ b/iptables/nft.c
|
|
|
029dc7 |
@@ -1660,6 +1660,8 @@ static int __nft_chain_user_del(struct nftnl_chain *c, void *data)
|
|
|
029dc7 |
fprintf(stdout, "Deleting chain `%s'\n",
|
|
|
029dc7 |
nftnl_chain_get_str(c, NFTNL_CHAIN_NAME));
|
|
|
029dc7 |
|
|
|
029dc7 |
+ /* XXX This triggers a fast lookup from the kernel. */
|
|
|
029dc7 |
+ nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
|
|
|
029dc7 |
ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_DEL, c);
|
|
|
029dc7 |
if (ret)
|
|
|
029dc7 |
return -1;
|
|
|
029dc7 |
--
|
|
|
029dc7 |
2.21.0
|
|
|
029dc7 |
|