netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC

Browse source

commit ba378ca9c0 upstream.

Fix lookup of existing match/target structures in the corresponding list
by skipping the family check if NFPROTO_UNSPEC is used.

This is resulting in the allocation and insertion of one match/target
structure for each use of them. So this not only bloats memory
consumption but also severely affects the time to reload the ruleset
from the iptables-compat utility.

After this patch, iptables-compat-restore and iptables-compat take
almost the same time to reload large rulesets.

Fixes: 0ca743a559 ("netfilter: nf_tables: add compatibility layer for x_tables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>

...

This commit is contained in:

Pablo Neira Ayuso 2015-09-14 18:04:09 +02:00 • committed by Luis Henriques

parent 34ad4e3e3a

commit cc4bc06249

1 changed files with 18 additions and 6 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

24

net/netfilter/nft_compat.c

View file