[Bug 1439] Atomically updating/reloading a large set with nft -f is excessively slow

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1439

Pablo Neira Ayuso <pablo at netfilter.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #10 from Pablo Neira Ayuso <pablo at netfilter.org> ---
(In reply to Timo Sigurdsson from comment #9)
> (In reply to Pablo Neira Ayuso from comment #8)
[...]
> > Are you sure you are running a fresh nft binary?
> 
> As mentioned in the other bug. You're right. My installation of the fresh
> binaries and libraries was somehow broken. I just assume I was running the
> new build since nft -v returned 0.9.6 (whereas Ubuntu 20.04 ships 0.9.3). I
> reinstalled the custom build from fresh and now it works. Loading the set
> for the first time takes ~0.6s and repeated loads take only slightly longer
> with ~0.9s. All good! Thanks!

Thank you for confirming this works for you.

> Another question: In a different bug you mentioned that your fix in nftables
> requires also an updated libnftnl. Is there a specific commit in libnftnl
> that is required by your change or does it depend on more changes? I'm
> asking because I'd like to try to backport the fix to Debian stable if the
> changes required are fairly small.

The next nftables version contains support for chain bindings:

https://git.netfilter.org/nftables/commit/?id=c330152b7f7779f15dba3e0862bf5616e7cb3eab

This requires this recent update for libftnl:

http://git.netfilter.org/libnftnl/commit/?id=20e0e8f2bec3b06ba5d77ec17d8e635750f4c085

This chain binding support requires Linux kernel 5.9-rc1 (yet to be release,
this is net-next material).

So, if you carefully pick the patches to backport - skipping the patches that
are related to the chain binding support - then you don't need the most recent
version of libnftnl.

Closing this bug.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200730/7c917878/attachment.html>