d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pfctl: improve rule load times with thousands of interfaces

Browse Source 
r343287 / D18759 introduced ifa_add_groups_to_map() which is now run by
ifa_load/ifa_lookup/host_if. When loading an anchor or ruleset via pfctl that
does NOT contain ifnames as hosts, host() still ends up iterating all
interfaces twice, grabbing SIOCGIFGROUP ioctl twice for each. This adds an
unnecessary amount of time on systems with thousands or tens of thousands of
interfaces.

Prioritize the IPv4/6 check over the interface name lookup, which skips loading
the iftab and iterating all interfaces when the configuration does not contain
interface names.

Submitted by:	Nick Rogers
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D24100
This commit is contained in:
Kristof Provost 2020-03-19 12:54:43 +00:00
parent 35c5ccf66d
commit d2568b024d
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=359130
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sbin/pfctl/pfctl_parser.c
View File

@ -1563,10 +1563,6 @@ host(const char *s)
mask = -1; mask = -1;
} }
/* interface with this name exists? */
if (cont && (h = host_if(ps, mask)) != NULL)
cont = 0;
/* IPv4 address? */ /* IPv4 address? */
if (cont && (h = host_v4(s, mask)) != NULL) if (cont && (h = host_v4(s, mask)) != NULL)
cont = 0; cont = 0;
@ -1575,6 +1571,11 @@ host(const char *s)
if (cont && (h = host_v6(ps, v6mask)) != NULL) if (cont && (h = host_v6(ps, v6mask)) != NULL)
cont = 0; cont = 0;
/* interface with this name exists? */
/* expensive with thousands of interfaces - prioritze IPv4/6 check */
if (cont && (h = host_if(ps, mask)) != NULL)
cont = 0;
/* dns lookup */ /* dns lookup */
if (cont && (h = host_dns(ps, v4mask, v6mask)) != NULL) if (cont && (h = host_dns(ps, v4mask, v6mask)) != NULL)
cont = 0; cont = 0;