[iptables RFC 0/2] Speed up restoring huge rulesets

[Phil Sutter <phil@nwl.cc>]

Spinning further on my OpenShift sample ruleset with 50k chains and 130k
rules (of which 90k jump to a chain), I discovered old work in a local
branch which surprisingly worked and is contained in patch 1:

Cache target lookup results if they failed. This speeds up the logic to
determine whether the rule's target is a chain for consecutive rules
jumping to that same chain. The cache does not care about table names,
but that's fine: If a given chain name is not an extension, that holds
for all chains of the same name in all tables.

Patch 2 goes even further by populating that cache from declared chains
in the parsed dump file. This is potentially problematic because it
effectively disables the chain name and extension clash check (which
didn't exist in nft-variant and was a warning only in legacy), and it
does that for all tables. So in theory, one could create a chain named
LOG in nat table and expect to still be able to use LOG target in filter
table. With patch 2 applied, the restore will fail.

I still find the series feasible despite its problems: The performance
improvement is immense (see numbers in patches) and it breaks only
corner-cases which are likely unintended anyway.

Phil Sutter (2):
  libxtables: Implement notargets hash table
  libxtables: Boost rule target checks by announcing chain names

 include/xtables.h           |  3 ++
 iptables/iptables-restore.c |  1 +
 iptables/xtables-restore.c  |  1 +
 libxtables/xtables.c        | 84 +++++++++++++++++++++++++++++++++++++
 4 files changed, 89 insertions(+)

-- 
2.34.1