diff options
| author | Phil Sutter <phil@nwl.cc> | 2019-09-25 18:20:24 +0200 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2019-10-17 19:02:50 +0200 |
| commit | 7b64c50904ae1ab6366a78e01a272532fac8af8f (patch) | |
| tree | 95595cd6467843b4e55e804d8e1e9c7e0bc31beb /iptables/nft.c | |
| parent | 026109dbece39ad27c43ebc31a17a22e5b581987 (diff) | |
nft: Reduce cache overhead of nft_chain_builtin_init()
There is no need for a full chain cache, fetch only the few builtin
chains that might need to be created.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables/nft.c')
| -rw-r--r-- | iptables/nft.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/iptables/nft.c b/iptables/nft.c index 775582aa..7e019d54 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -709,15 +709,16 @@ nft_chain_builtin_find(const struct builtin_table *t, const char *chain) static void nft_chain_builtin_init(struct nft_handle *h, const struct builtin_table *table) { - struct nftnl_chain_list *list = nft_chain_list_get(h, table->name, NULL); + struct nftnl_chain_list *list; struct nftnl_chain *c; int i; - if (!list) - return; - /* Initialize built-in chains if they don't exist yet */ for (i=0; i < NF_INET_NUMHOOKS && table->chains[i].name != NULL; i++) { + list = nft_chain_list_get(h, table->name, + table->chains[i].name); + if (!list) + continue; c = nftnl_chain_list_lookup_byname(list, table->chains[i].name); if (c != NULL) |