diff options
| author | zsdc <taras@vyos.io> | 2022-09-12 18:07:01 +0300 |
|---|---|---|
| committer | zsdc <taras@vyos.io> | 2022-09-19 20:16:12 +0300 |
| commit | d55b9e14c14011577354b69cc569d2652d5e31fd (patch) | |
| tree | 76c0e49c9149586f29630a457bf4854a26507d3e /templates/firewall | |
| parent | 6de742432786b4035842d3e3f2e4a10df68199f2 (diff) | |
| download | vyatta-cfg-firewall-d55b9e14c14011577354b69cc569d2652d5e31fd.tar.gz vyatta-cfg-firewall-d55b9e14c14011577354b69cc569d2652d5e31fd.zip | |
ipset: T2189: optimized firewall groups performance
This commit optimizes the speed of interaction with the ipset.
* removed extra `sudo` from `ipset` commands, because scripts that run `ipset`
commands already run under `sudo`. This gives approximately 4x performance
improvement.
* replaced logic in the `member_exists` function for port groups. Instead of
calling `ipset -T` for each port now the whole list is received in one command
and a search process is done inside Perl. This significantly improves speed for
port groups with long port ranges inside.
* delete ip address and port ranges using a single command instead deleting
each element individually.
* added the same ranges validation for address-group as for port-group.
Diffstat (limited to 'templates/firewall')
| -rw-r--r-- | templates/firewall/group/address-group/node.def | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/templates/firewall/group/address-group/node.def b/templates/firewall/group/address-group/node.def index d89233d..b210fc1 100644 --- a/templates/firewall/group/address-group/node.def +++ b/templates/firewall/group/address-group/node.def @@ -19,6 +19,10 @@ syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defi --set-type=address --set-family=inet"; \ "Firewall group name already used as Ipv6 group address" +commit:expression:exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=check-duplicates --set-name=$VAR(@) \ + --set-type=address --set-family=inet"; \ + "There are duplicates inside address-group $VAR(@)" + end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \ --set-name="$VAR(@)" --set-type=address --set-family=inet; then ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group address-group $VAR(@)" |