netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC
authorPablo Neira Ayuso <pablo@netfilter.org>
Mon, 14 Sep 2015 16:04:09 +0000 (18:04 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 14 Sep 2015 16:10:57 +0000 (18:10 +0200)
commitba378ca9c04a5fc1b2cf0f0274a9d02eb3d1bad9
tree8665ae84918021d813e2f072ab6ae6cfb1fdc424
parent63cdbc06b357dcb3a7104a421ee4a4550d7fadfd
netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC

Fix lookup of existing match/target structures in the corresponding list
by skipping the family check if NFPROTO_UNSPEC is used.

This is resulting in the allocation and insertion of one match/target
structure for each use of them. So this not only bloats memory
consumption but also severely affects the time to reload the ruleset
from the iptables-compat utility.

After this patch, iptables-compat-restore and iptables-compat take
almost the same time to reload large rulesets.

Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nft_compat.c