From e6b8e172fca48f5d80699afe80947b0fc1f23fd6 Mon Sep 17 00:00:00 2001 From: Tomasz Bursztyka Date: Tue, 11 Feb 2014 18:36:44 +0200 Subject: nft: Initialize a table only once This helps to remove some runtime overhead, especially when running xtables-restore. Signed-off-by: Tomasz Bursztyka Signed-off-by: Pablo Neira Ayuso --- iptables/nft.c | 10 ++++++++++ iptables/nft.h | 1 + 2 files changed, 11 insertions(+) (limited to 'iptables') diff --git a/iptables/nft.c b/iptables/nft.c index 501c6d86..49322bdd 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -436,6 +436,9 @@ nft_table_builtin_add(struct nft_handle *h, struct builtin_table *_t, struct nft_table *t; int ret; + if (_t->initialized) + return 0; + t = nft_table_alloc(); if (t == NULL) return -1; @@ -464,6 +467,10 @@ nft_table_builtin_add(struct nft_handle *h, struct builtin_table *_t, if (errno != EEXIST) perror("mnl-talk:nft_table_init_one"); } + + if (ret == 0 || errno == EEXIST) + _t->initialized = true; + return ret; } @@ -2414,6 +2421,9 @@ int nft_xtables_config_load(struct nft_handle *h, const char *filename, uint32_t table_family, chain_family; bool found = false; + if (h->restore) + return 0; + if (xtables_config_parse(filename, table_list, chain_list) < 0) { if (errno == ENOENT) { xtables_config_perror(flags, diff --git a/iptables/nft.h b/iptables/nft.h index 3b58d514..c31371c0 100644 --- a/iptables/nft.h +++ b/iptables/nft.h @@ -22,6 +22,7 @@ struct builtin_chain { struct builtin_table { const char *name; struct builtin_chain chains[NF_INET_NUMHOOKS]; + bool initialized; }; struct nft_handle { -- cgit v1.2.3