cache: chain listing implicitly sets on terse option

commit 70d99ce8bf8bd3dab84ea0a6249812b04ec95b8c upstream.

If user specifies a chain to be listed (which is internally handled via
filtering options), then toggle NFT_CACHE_TERSE to skip fetching set
content from kernel for non-anonymous sets.

With a large IPv6 set with bogons, before this patch:

 # time nft list chain inet raw x
 table inet raw {
        chain x {
                ip6 saddr @bogons6
                ip6 saddr { aaaa::, bbbb:: }
        }
 }

 real    0m2,913s
 user    0m1,345s
 sys     0m1,568s

After this patch:

 # time nft list chain inet raw prerouting
 table inet raw {
        chain x {
                ip6 saddr @bogons6
                ip6 saddr { aaaa::, bbbb:: }
        }
 }

 real    0m0,056s
 user    0m0,018s
 sys     0m0,039s

This speeds up chain listing in the presence of a large set.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/cache.c b/src/cache.c
index 2e96a489c261758e1027cf950e9c8c1e52ac96a7..5e6074f19ce165ea27bd4763bb3d363fd94c477d 100644 (file)
--- a/src/cache.c
+++ b/src/cache.c
@@ -208,6 +208,10 @@ static unsigned int evaluate_cache_list(struct nft_ctx *nft, struct cmd *cmd,
                        filter->list.family = cmd->handle.family;
                        filter->list.table = cmd->handle.table.name;
                        filter->list.chain = cmd->handle.chain.name;
+                       /* implicit terse listing to fetch content of anonymous
+                        * sets only when chain name is specified.
+                        */
+                       flags |= NFT_CACHE_TERSE;
                }
                flags |= NFT_CACHE_FULL;
                break;