cache: populate chains on demand from error path

commit babc6ee8773cfeed78167f78827b35e3141e04c6 upstream.

Updates on verdict maps that require many non-base chains are slowed
down due to fetching existing non-base chains into the cache.

Chains are only required for error reporting hints if kernel reports
ENOENT. Populate the cache from this error path only.

Similar approach already exists from rule ENOENT error path since:

  deb7c5927fad ("cmd: add misspelling suggestions for rule commands")

however, NFT_CACHE_CHAIN was toggled inconditionally for rule
commands, rendering this on-demand cache population useless.

before this patch, running Neels' nft_slew benchmark (peak values):

  created idx 4992 in 52587950 ns   (128 in 7122 ms)
  ...
  deleted idx  128 in 43542500 ns   (127 in 6187 ms)

after this patch:

  created idx 4992 in 11361299 ns   (128 in 1612 ms)
  ...
  deleted idx 1664 in  5239633 ns   (128 in 733 ms)

Tested-by: Eric Garver <eric@garver.life>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/cache.h b/include/cache.h
index 575381ef971bc360c1ac716075a5b8abe92e8df0..c0aff3b1489fced770b3e3eac8ef1294e82f4fb4 100644 (file)
--- a/include/cache.h
+++ b/include/cache.h
@@ -29,7 +29,6 @@ enum cache_level_flags {
                                  NFT_CACHE_SET_BIT |
                                  NFT_CACHE_SETELEM_BIT,
        NFT_CACHE_RULE          = NFT_CACHE_TABLE_BIT |
-                                 NFT_CACHE_CHAIN_BIT |
                                  NFT_CACHE_RULE_BIT,
        NFT_CACHE_FULL          = __NFT_CACHE_MAX_BIT - 1,
        NFT_CACHE_TERSE         = (1 << 27),

diff --git a/src/cache.c b/src/cache.c
index a92897ccd8099af8c2ad7f3a12fccb28ead58e77..733d333dedc5774210360e1daa92e4eedf1b27d3 100644 (file)
--- a/src/cache.c
+++ b/src/cache.c
@@ -28,7 +28,6 @@ static unsigned int evaluate_cache_add(struct cmd *cmd, unsigned int flags)
                        break;
 
                flags |= NFT_CACHE_TABLE |
-                        NFT_CACHE_CHAIN |
                         NFT_CACHE_SET |
                         NFT_CACHE_OBJECT |
                         NFT_CACHE_FLOWTABLE;
@@ -52,14 +51,12 @@ static unsigned int evaluate_cache_add(struct cmd *cmd, unsigned int flags)
                break;
        case CMD_OBJ_ELEMENTS:
                flags |= NFT_CACHE_TABLE |
-                        NFT_CACHE_CHAIN |
                         NFT_CACHE_SET |
                         NFT_CACHE_OBJECT |
                         NFT_CACHE_SETELEM_MAYBE;
                break;
        case CMD_OBJ_RULE:
                flags |= NFT_CACHE_TABLE |
-                        NFT_CACHE_CHAIN |
                         NFT_CACHE_SET |
                         NFT_CACHE_OBJECT |
                         NFT_CACHE_FLOWTABLE;
@@ -394,7 +391,6 @@ int nft_cache_evaluate(struct nft_ctx *nft, struct list_head *cmds,
                        break;
                case CMD_DELETE:
                        flags |= NFT_CACHE_TABLE |
-                                NFT_CACHE_CHAIN |
                                 NFT_CACHE_SET |
                                 NFT_CACHE_FLOWTABLE |
                                 NFT_CACHE_OBJECT;

diff --git a/src/cmd.c b/src/cmd.c
index d9a946425dd1872145f91b9a5a1e193b7da02072..f315780f3d98208da25de34eca075b9259c37e4e 100644 (file)
--- a/src/cmd.c
+++ b/src/cmd.c
@@ -55,6 +55,10 @@ static int nft_cmd_enoent_chain(struct netlink_ctx *ctx, const struct cmd *cmd,
        if (!cmd->handle.chain.name)
                return 0;
 
+       if (nft_cache_update(ctx->nft, NFT_CACHE_TABLE | NFT_CACHE_CHAIN,
+                            ctx->msgs, NULL) < 0)
+               return 0;
+
        chain = chain_lookup_fuzzy(&cmd->handle, &ctx->nft->cache, &table);
        /* check table first. */
        if (!table)
@@ -251,6 +255,13 @@ static int nft_cmd_chain_error(struct netlink_ctx *ctx, struct cmd *cmd,
                        return netlink_io_error(ctx, &chain->priority.loc,
                                                "Chains of type \"nat\" must have a priority value above -200");
 
+               if (nft_cache_update(ctx->nft, NFT_CACHE_TABLE | NFT_CACHE_CHAIN,
+                                    ctx->msgs, NULL) < 0) {
+                       return netlink_io_error(ctx, &chain->loc,
+                                               "Chain of type \"%s\" is not supported, perhaps kernel support is missing?",
+                                               chain->type.str);
+               }
+
                table = table_cache_find(&ctx->nft->cache.table_cache,
                                         cmd->handle.table.name, cmd->handle.family);
                if (table) {