When restoring a ruleset, feed libxtables with chain names from respective lines to avoid extension searches for them when parsing rules jumping to them later. This is kind of a double-edged blade: the obvious downside is that *tables-restore won't detect user-defined chain name and extension clashes anymore. The upside is a tremendous performance improvement restoring large rulesets. The same crooked ruleset as mentioned in earlier patches (50k chains, 130k rules of which 90k jump to a chain) yields these numbers: variant unoptimized non-targets cache announced chains ---------------------------------------------------------------- legacy 1m12s 37s 2.5s nft 1m35s 53s 8s Note that iptables-legacy-restore allows the clashes already as long as the name does not match a standard target, but with this patch it stops warning about it. iptables-nft-restore does not care at all, even allows adding a chain named 'ACCEPT' (and rules can't reach it because '-j ACCEPT' translates to a native nftables verdict). The latter is a bug by itself. Signed-off-by: Phil Sutter <phil@xxxxxx> --- include/xtables.h | 3 +++ iptables/iptables-restore.c | 1 + iptables/xtables-restore.c | 1 + libxtables/xtables.c | 6 ++++++ 4 files changed, 11 insertions(+) diff --git a/include/xtables.h b/include/xtables.h index ca674c2663eb4..816a157d5577d 100644 --- a/include/xtables.h +++ b/include/xtables.h @@ -645,6 +645,9 @@ const char *xt_xlate_get(struct xt_xlate *xl); #define xt_xlate_rule_get xt_xlate_get const char *xt_xlate_set_get(struct xt_xlate *xl); +/* informed target lookups */ +void xtables_announce_chain(const char *name); + #ifdef XTABLES_INTERNAL /* Shipped modules rely on this... */ diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c index 1917fb2315665..4cf0d3dadead9 100644 --- a/iptables/iptables-restore.c +++ b/iptables/iptables-restore.c @@ -308,6 +308,7 @@ ip46tables_restore_main(const struct iptables_restore_cb *cb, cb->ops->strerror(errno)); } + xtables_announce_chain(chain); ret = 1; } else if (in_table) { diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c index 81b25a43c9a04..4f9ffefdfab22 100644 --- a/iptables/xtables-restore.c +++ b/iptables/xtables-restore.c @@ -201,6 +201,7 @@ static void xtables_restore_parse_line(struct nft_handle *h, policy, chain, line, strerror(errno)); } + xtables_announce_chain(chain); ret = 1; } else if (state->in_table) { char *pcnt = NULL; diff --git a/libxtables/xtables.c b/libxtables/xtables.c index 3cb9a87c9406d..96ba16014af46 100644 --- a/libxtables/xtables.c +++ b/libxtables/xtables.c @@ -322,6 +322,12 @@ static void notargets_hlist_insert(const char *name) hlist_add_head(&cur->node, ¬argets[djb_hash(name) % NOTARGET_HSIZE]); } +void xtables_announce_chain(const char *name) +{ + if (!notargets_hlist_lookup(name)) + notargets_hlist_insert(name); +} + void xtables_init(void) { /* xtables cannot be used with setuid in a safe way. */ -- 2.34.1