From: Phil Sutter Date: Wed, 12 Dec 2018 19:04:12 +0000 (+0100) Subject: xtables: Speed up chain deletion in large rulesets X-Git-Tag: v1.8.3~73 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a5f517a41d72794fae3d1332e6e0e413a5cd16c1;p=thirdparty%2Fiptables.git xtables: Speed up chain deletion in large rulesets Kernel prefers to identify chain by handle if it was given which causes manual traversal of the chain list. In contrast, chain lookup by name in kernel makes use of a hash table so is considerably faster. Force this code path by removing the cached chain's handle when removing it. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- diff --git a/iptables/nft.c b/iptables/nft.c index 83d373c9..2fa973cf 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -1670,6 +1670,8 @@ static int __nft_chain_user_del(struct nftnl_chain *c, void *data) fprintf(stdout, "Deleting chain `%s'\n", nftnl_chain_get_str(c, NFTNL_CHAIN_NAME)); + /* XXX This triggers a fast lookup from the kernel. */ + nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE); ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_DEL, c); if (ret) return -1;