mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 02:39:48 +00:00
![]() The dummy ruleset I used to test the original validation change was broken, most rules were unreachable and were not tested by mark_source_chains(). In some cases rulesets that used to load in a few seconds now require several minutes. sample ruleset that shows the behaviour: echo "*filter" for i in $(seq 0 100000);do printf ":chain_%06x - [0:0]\n" $i done for i in $(seq 0 100000);do printf -- "-A INPUT -j chain_%06x\n" $i printf -- "-A INPUT -j chain_%06x\n" $i printf -- "-A INPUT -j chain_%06x\n" $i done echo COMMIT [ pipe result into iptables-restore ] This ruleset will be about 74mbyte in size, with ~500k searches though all 500k[1] rule entries. iptables-restore will take forever (gave up after 10 minutes) Instead of always searching the entire blob for a match, fill an array with the start offsets of every single ipt_entry struct, then do a binary search to check if the jump target is present or not. After this change ruleset restore times get again close to what one gets when reverting |
||
---|---|---|
.. | ||
ipset | ||
nf_conntrack_amanda.h | ||
nf_conntrack_common.h | ||
nf_conntrack_dccp.h | ||
nf_conntrack_ftp.h | ||
nf_conntrack_h323.h | ||
nf_conntrack_h323_asn1.h | ||
nf_conntrack_h323_types.h | ||
nf_conntrack_irc.h | ||
nf_conntrack_pptp.h | ||
nf_conntrack_proto_gre.h | ||
nf_conntrack_sane.h | ||
nf_conntrack_sctp.h | ||
nf_conntrack_sip.h | ||
nf_conntrack_snmp.h | ||
nf_conntrack_tcp.h | ||
nf_conntrack_tftp.h | ||
nf_conntrack_zones_common.h | ||
nfnetlink.h | ||
nfnetlink_acct.h | ||
x_tables.h | ||
xt_hashlimit.h | ||
xt_physdev.h |