| Message ID | 20240110144619.32070-2-phil@nwl.cc |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [iptables,1/2] Revert "xshared: Print protocol numbers if --numeric was given" | expand |
diff --git a/iptables/xshared.c b/iptables/xshared.c index 6d4ae992a5591..53704c6908133 100644 --- a/iptables/xshared.c +++ b/iptables/xshared.c @@ -1097,7 +1097,7 @@ void save_rule_details(const char *iniface, const char *outiface, } if (proto > 0) { - const char *pname = proto_to_name(proto, 0); + const char *pname = proto_to_name(proto, true); if (invflags & XT_INV_PROTO) printf(" !");
Instrument proto_to_name() to abort if given protocol number is not among the well-known ones in xtables_chain_protos. Along with xtables_parse_protocol() preferring said array for lookups as well, this ensures reliable dump'n'restore regardless of /etc/protocols contents. Another benefit is rule dump performance. A simple test-case dumping 100k rules matching on dccp protocol shows an 8s delta (2s vs. 10s for legacy, 0.5s vs. 8s for nft) with this patch applied. For reference: | for variant in nft legacy; do | ( | echo "*filter" | for ((i = 0; i < 100000; i++)); do | echo "-A FORWARD -p dccp -j ACCEPT" | done | echo "COMMIT" | ) | iptables-${variant}-restore | time iptables-${variant}-save | wc -l | iptables-${variant} -F | done Signed-off-by: Phil Sutter <phil@nwl.cc> --- iptables/xshared.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)