diff options
| author | Phil Sutter <phil@nwl.cc> | 2022-03-01 19:46:21 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2022-03-10 17:38:31 +0100 |
| commit | 07ee529f5a62838d68be59683be99bf6a7cda0f2 (patch) | |
| tree | 60454796d86f28ecdc76ce10656de049af73c2b7 /iptables/nft-bridge.c | |
| parent | b5f2faea325a315bfb932ebc634f3298d4824cae (diff) | |
nft: Speed up immediate parsing
Parsing of rules which jump to a chain pointlessly causes a call to
xtables_find_target() despite the code already knowing the outcome.
Avoid the significant delay for rulesets with many chain jumps by
performing the (standard) target lookup only for accept/drop/return
verdicts.
From a biased test-case on my VM:
| # iptables-nft-save | grep -c -- '-j'
| 133943
| # time ./old/iptables-nft-save >/dev/null
| real 0m45.566s
| user 0m1.308s
| sys 0m8.430s
| # time ./new/iptables-nft-save >/dev/null
| real 0m3.547s
| user 0m0.762s
| sys 0m2.476s
Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'iptables/nft-bridge.c')
| -rw-r--r-- | iptables/nft-bridge.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c index d6a0d6e5..d342858e 100644 --- a/iptables/nft-bridge.c +++ b/iptables/nft-bridge.c @@ -502,6 +502,7 @@ static void nft_bridge_parse_target(struct xtables_target *t, void *data) } cs->target = t; + cs->jumpto = t->name; } static void nft_rule_to_ebtables_command_state(struct nft_handle *h, |