[iptables RFC 2/2] libxtables: Boost rule target checks by announcing chain names

[Phil Sutter <phil@xxxxxx>]

When restoring a ruleset, feed libxtables with chain names from
respective lines to avoid extension searches for them when parsing rules
jumping to them later.

This is kind of a double-edged blade: the obvious downside is that
*tables-restore won't detect user-defined chain name and extension
clashes anymore. The upside is a tremendous performance improvement
restoring large rulesets. The same crooked ruleset as mentioned in
earlier patches (50k chains, 130k rules of which 90k jump to a chain)
yields these numbers:

variant	 unoptimized	non-targets cache	announced chains
----------------------------------------------------------------
legacy   1m12s		37s			2.5s
nft      1m35s		53s			8s

Note that iptables-legacy-restore allows the clashes already as long as
the name does not match a standard target, but with this patch it stops
warning about it. iptables-nft-restore does not care at all, even allows
adding a chain named 'ACCEPT' (and rules can't reach it because '-j
ACCEPT' translates to a native nftables verdict). The latter is a bug by
itself.

Signed-off-by: Phil Sutter <phil@xxxxxx>
---
 include/xtables.h           | 3 +++
 iptables/iptables-restore.c | 1 +
 iptables/xtables-restore.c  | 1 +
 libxtables/xtables.c        | 6 ++++++
 4 files changed, 11 insertions(+)

diff --git a/include/xtables.h b/include/xtables.h
index ca674c2663eb4..816a157d5577d 100644
--- a/include/xtables.h
+++ b/include/xtables.h
@@ -645,6 +645,9 @@ const char *xt_xlate_get(struct xt_xlate *xl);
 #define xt_xlate_rule_get xt_xlate_get
 const char *xt_xlate_set_get(struct xt_xlate *xl);
 
+/* informed target lookups */
+void xtables_announce_chain(const char *name);
+
 #ifdef XTABLES_INTERNAL
 
 /* Shipped modules rely on this... */
diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c
index 1917fb2315665..4cf0d3dadead9 100644
--- a/iptables/iptables-restore.c
+++ b/iptables/iptables-restore.c
@@ -308,6 +308,7 @@ ip46tables_restore_main(const struct iptables_restore_cb *cb,
 						cb->ops->strerror(errno));
 			}
 
+			xtables_announce_chain(chain);
 			ret = 1;
 
 		} else if (in_table) {
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
index 81b25a43c9a04..4f9ffefdfab22 100644
--- a/iptables/xtables-restore.c
+++ b/iptables/xtables-restore.c
@@ -201,6 +201,7 @@ static void xtables_restore_parse_line(struct nft_handle *h,
 				      policy, chain, line,
 				      strerror(errno));
 		}
+		xtables_announce_chain(chain);
 		ret = 1;
 	} else if (state->in_table) {
 		char *pcnt = NULL;
diff --git a/libxtables/xtables.c b/libxtables/xtables.c
index 3cb9a87c9406d..96ba16014af46 100644
--- a/libxtables/xtables.c
+++ b/libxtables/xtables.c
@@ -322,6 +322,12 @@ static void notargets_hlist_insert(const char *name)
 	hlist_add_head(&cur->node, &notargets[djb_hash(name) % NOTARGET_HSIZE]);
 }
 
+void xtables_announce_chain(const char *name)
+{
+	if (!notargets_hlist_lookup(name))
+		notargets_hlist_insert(name);
+}
+
 void xtables_init(void)
 {
 	/* xtables cannot be used with setuid in a safe way. */
-- 
2.34.1