Spinning further on my OpenShift sample ruleset with 50k chains and 130k rules (of which 90k jump to a chain), I discovered old work in a local branch which surprisingly worked and is contained in patch 1: Cache target lookup results if they failed. This speeds up the logic to determine whether the rule's target is a chain for consecutive rules jumping to that same chain. The cache does not care about table names, but that's fine: If a given chain name is not an extension, that holds for all chains of the same name in all tables. Patch 2 goes even further by populating that cache from declared chains in the parsed dump file. This is potentially problematic because it effectively disables the chain name and extension clash check (which didn't exist in nft-variant and was a warning only in legacy), and it does that for all tables. So in theory, one could create a chain named LOG in nat table and expect to still be able to use LOG target in filter table. With patch 2 applied, the restore will fail. I still find the series feasible despite its problems: The performance improvement is immense (see numbers in patches) and it breaks only corner-cases which are likely unintended anyway. Phil Sutter (2): libxtables: Implement notargets hash table libxtables: Boost rule target checks by announcing chain names include/xtables.h | 3 ++ iptables/iptables-restore.c | 1 + iptables/xtables-restore.c | 1 + libxtables/xtables.c | 84 +++++++++++++++++++++++++++++++++++++ 4 files changed, 89 insertions(+) -- 2.34.1
