<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - `nft list' is very slow when output contains meters that has lots of elements"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1326">1326</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>`nft list' is very slow when output contains meters that has lots of elements
</td>
</tr>
<tr>
<th>Product</th>
<td>nftables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>Debian GNU/Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>nft
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pablo@netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>richard0053@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>I am running an NTP server and trying to add some basic rate limit on the
service. The rule in use is basically matching UDP packets to the NTP port and
apply a meter on it. But after adding the rule, the `nft list` command takes a
long time to execute, even if I do not ask for the content of the meter:
# time nft list table ip filter
table ip filter {
chain input {
type filter hook input priority 0; policy accept;
iifname "ens2" udp dport ntp meter ntp-rate-limit size 65535 {
ip saddr timeout 1m limit rate over 600/minute} drop
}
chain forward {
type filter hook forward priority 0; policy accept;
}
chain output {
type filter hook output priority 0; policy accept;
}
}
real 0m2.837s
user 0m0.320s
sys 0m1.200s
Even for a completely unrelated table:
# time nft list table ip sshguard
table ip sshguard {
set attackers {
type ipv4_addr
flags interval
elements = { 118.25.1.73, 120.92.15.82,
122.2.16.126, 193.112.52.201,
222.186.30.71 }
}
chain blacklist {
type filter hook input priority -10; policy accept;
ip saddr @attackers drop
}
}
real 0m2.857s
user 0m0.356s
sys 0m1.150s
strace shows that nft is receiving lots of messages from the netlink socket.
The meter `ntp-rate-limit' does contain a lot of elements.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>