]> git.ipfire.org Git - thirdparty/iptables.git/commit
nft: Speed up immediate parsing
authorPhil Sutter <phil@nwl.cc>
Tue, 1 Mar 2022 18:46:21 +0000 (19:46 +0100)
committerPhil Sutter <phil@nwl.cc>
Thu, 10 Mar 2022 16:38:31 +0000 (17:38 +0100)
commit07ee529f5a62838d68be59683be99bf6a7cda0f2
tree60454796d86f28ecdc76ce10656de049af73c2b7
parentb5f2faea325a315bfb932ebc634f3298d4824cae
nft: Speed up immediate parsing

Parsing of rules which jump to a chain pointlessly causes a call to
xtables_find_target() despite the code already knowing the outcome.

Avoid the significant delay for rulesets with many chain jumps by
performing the (standard) target lookup only for accept/drop/return
verdicts.

From a biased test-case on my VM:

| # iptables-nft-save | grep -c -- '-j'
| 133943
| # time ./old/iptables-nft-save >/dev/null
| real 0m45.566s
| user 0m1.308s
| sys 0m8.430s
| # time ./new/iptables-nft-save >/dev/null
| real 0m3.547s
| user 0m0.762s
| sys 0m2.476s

Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Florian Westphal <fw@strlen.de>
iptables/nft-bridge.c
iptables/nft-shared.c