From d55b9e14c14011577354b69cc569d2652d5e31fd Mon Sep 17 00:00:00 2001 From: zsdc Date: Mon, 12 Sep 2022 18:07:01 +0300 Subject: ipset: T2189: optimized firewall groups performance This commit optimizes the speed of interaction with the ipset. * removed extra `sudo` from `ipset` commands, because scripts that run `ipset` commands already run under `sudo`. This gives approximately 4x performance improvement. * replaced logic in the `member_exists` function for port groups. Instead of calling `ipset -T` for each port now the whole list is received in one command and a search process is done inside Perl. This significantly improves speed for port groups with long port ranges inside. * delete ip address and port ranges using a single command instead deleting each element individually. * added the same ranges validation for address-group as for port-group. --- templates/firewall/group/address-group/node.def | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'templates/firewall') diff --git a/templates/firewall/group/address-group/node.def b/templates/firewall/group/address-group/node.def index d89233d..b210fc1 100644 --- a/templates/firewall/group/address-group/node.def +++ b/templates/firewall/group/address-group/node.def @@ -19,6 +19,10 @@ syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defi --set-type=address --set-family=inet"; \ "Firewall group name already used as Ipv6 group address" +commit:expression:exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=check-duplicates --set-name=$VAR(@) \ + --set-type=address --set-family=inet"; \ + "There are duplicates inside address-group $VAR(@)" + end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \ --set-name="$VAR(@)" --set-type=address --set-family=inet; then ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group address-group $VAR(@)" -- cgit v1.2.3