From nobody Thu Nov 12 15:08:21 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1794227824; cv=none; d=zohomail.com; s=zohoarc; b=gs9vscG6G++rMbX1jIbjrXPadnCK8SBKJtUJzntUJ/hHRxSLcGs8LFLyVuiy4fX9aW/qacg4kf6gGWquBF1bzVQ3LY9M9LHghqaUyR84cVtIgGpBwn82S9/x79kEL9X4QBr8wYumC7Q151zY+JZPxzyJrHi+MeWL3eqO1reVBZw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1794227824; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=HYRZ2L9CaSSaUFumBolPIa19rm+I1Ic25W+hx4DKRbs=; b=lqFiDOz7HQY6WnA9yQPWh7xRQPrhmq0vKW8upQFtor3Z7zyFVQGdNytiQgBWE5/sDyuV6lxxrLFPIxBDSHM05+jCrDr2EM7IHhZKytWgq04SZtCr7/0Dk20O8mhMLD6Q7jNYnTqNvh2nEqBlwwiQ5QgYe5/TxtmPKgIBXBJJTHc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1794227824118974.9817486664631; Mon, 9 Nov 2026 04:37:04 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id E55C541B3D; Mon, 9 Nov 2026 07:37:02 -0500 (EST) Received: from [172.19.199.22] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 5DE4F41D2F; Mon, 9 Nov 2026 07:28:04 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 828A43F290; Sat, 7 Nov 2026 07:47:06 -0500 (EST) Received: from mail-vs1-xe32.google.com (mail-vs1-xe32.google.com [IPv6:2607:f8b0:4864:20::e32]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id DD3073F308 for ; Sat, 7 Nov 2026 07:47:05 -0500 (EST) Received: by mail-vs1-xe32.google.com with SMTP id ada2fe7eead31-7c3b75caad1so989638137.0 for ; Sat, 07 Nov 2026 04:47:05 -0800 (PST) Received: from dimas-desktop.dimas.systems ([189.6.6.152]) by smtp.gmail.com with ESMTPSA id ada2fe7eead31-7d2a8bbac51sm3621623137.11.2026.11.07.04.47.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 07 Nov 2026 04:47:04 -0800 (PST) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=0.6 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, RCVD_IN_SBL_CSS,SPF_HELO_NONE autolearn=no autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794055625; x=1794660425; darn=lists.libvirt.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=HYRZ2L9CaSSaUFumBolPIa19rm+I1Ic25W+hx4DKRbs=; b=qxpRa7aEYneYY2qjwGQVA1N0PV0k6di+Mack/8A1XPsF/++DzsuYEazOMcwArOPwPH lOlaGLOQkX5xX0EPpVpiICU7V0yETA/QQwj7bqdqDJp3EMSCVWtUn1HWdO6tURfRyDEK oPjyhbf62PouzI54dYcq6pVITLfieR/2ZUTA8k4tv0jy7CTa4B5kPerlCpKtsr4y+jIs CFqFQ2GF9SMRhzYqgSTNNagfAeeloeR5ghLhf18J5+tnRIfVJ7XuHwSqsOIxeFPT/GuW X4mECbUP7h/Dp3TpOJ2yIs0m9IHm7zbGRvxN91MzFM5vNGB+HU6TcLbbj9cNN4JnYIml wadw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794055625; x=1794660425; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=HYRZ2L9CaSSaUFumBolPIa19rm+I1Ic25W+hx4DKRbs=; b=AiQTHrVG97Lj9+Cl4ag2CcsHf59Hum1PiXv94c0u0VML2/tgHWYBK4pEJfQM8AO0BW BbbGd3EmoPh7f528khe80QFTc0uu3WTE6VXdvx+jziXbagd1jb/dxMonhPVk4EQOKV9b IQL7Pbf2/GhuNAAFElzoXafsLuMEhfoEqtTzyA7BWhbxRfUf0dNJnHGDUswGJkQvQPBT aml+Y5yzg3KHuGU5H1YEl+zBDQLFH+vd88gTX6YdLYRNVJepUv6pv5Jowbsgmmx+OHOc 8g0qaF/K/MAjbZDhB2DG0oMn1J5m/EwUgz7AgpOip5hM+sn1WLzS5IF9PIZpZ7grbhE6 pUUw== X-Gm-Message-State: APuU4Z+fLFhTRgdJwMtZeyCiwVsWZYL0IZRs4hqndlMpzRxPr+fEQ/7c C1xm+45sb4jEFMsGPxY/uFM6pThkK5qhBAvvXewoXhl7jiJaRneyMjBs2QiWdGof X-Gm-Gg: AYBFou3CZbX7ssU/lveFWgk5pyceQ8s+OkOkPYplFYIV9otbBUSbQ2GJZGu4/qXVP5s JTdf35wfDbziHFulc4cJ8XhlcvkOsqqQkMaqXC6Yvihow4ZavCc3qcrr/FyyIfmEOkWXEL+zTBk pUajNOI+KGKUjT+CMoVoi4q5St0jHEsAyPg7Y3hfUSNENMLGIu4I8HQYsGJ65Im7ljbfhbmviNC rjVEIsjHHTYitZEK5erZl1/0C1GBlHM1EnossChbnkbWfVCAfKuGbw402Nu8/d+7Hp2eofGHMcZ EauKjUr+0qWBen/hobHy2h0PdVsjfHRvl+yPHWr9hxhgvNlPmY3gFpEZBrqTu64w4r8eoJdklT+ SV69PCJTG2ARfDE8UiNWeKzG94RcvevdnGfR+D539ZAKg9dkzucVXsYajECHj+X31QEVk0BRQho j6+nnzzef7wEPgtimRdGMGhAEK9SDhC1IgP9Gag/2tGWNiam3RDkJxviFsDgpaXwXZ253blwpiL pAc7ALbzAu6fPJwwqX3ryDI53POG/GpDQEf+e23GKPllqplPfAz3AT/h1H2Wot1TtgDxuMjlaMA APzK56mB6gA82qdPKoM70e/7/J0+WM9sEGC1JT0LlNrK3CjmevF0vA9NpoQqG3pTDytLaAxRa9x L2fg4EFsrpaWdOSa215lwyPFHyV79jHJjjqtT X-Received: by 2002:a05:6102:6f06:b0:7a7:198a:c2bc with SMTP id ada2fe7eead31-7d2a16ab15emr2136541137.36.1794055625274; Sat, 07 Nov 2026 04:47:05 -0800 (PST) From: Dimas Moreira Junior To: devel@lists.libvirt.org Subject: [PATCH] nwfilter: Use numeric output when listing iptables chains Date: Sat, 7 Nov 2026 09:46:48 -0300 Message-ID: <20261107124648.2391657-1-dimasmjunior@gmail.com> X-Mailer: git-send-email 2.56.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-MailFrom: dimasmjunior@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation Message-ID-Hash: JTTD6KMXUVRLQ66RGVICEDQA5PIT7XKT X-Message-ID-Hash: JTTD6KMXUVRLQ66RGVICEDQA5PIT7XKT X-Mailman-Approved-At: Mon, 09 Nov 2026 12:27:56 +0000 CC: Dimas Moreira Junior X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1794227826275158500 Content-Type: text/plain; charset="utf-8" iptablesCreateChainsAndRules() runs "iptables -L" and "ip6tables -L" to find out which base chains already exist. Without -n, iptables reverse-resolves every address in every rule it lists. The callback only looks at lines starting with "Chain ", so the resolved names are never used, but the lookups run anyway and their cost grows with the number of rules. Where reverse lookups are slow this delays filter setup in proportion to the rule count. On a Fedora 44 host with libvirt 12.0.0, a guest whose filter rules contained about 70 addresses took longer than 30 seconds to start. With numeric listing, creation took under a second. Pass -n so iptables skips the lookups. The "Chain" header lines the callback parses are the same in numeric mode. The "ebtables -t nat -L" listings are left alone: ebtables does not accept -n and rejects it as an unknown option. Resolves: https://gitlab.com/libvirt/libvirt/-/issues/944 Signed-off-by: Dimas Moreira Junior --- src/nwfilter/nwfilter_ebiptables_driver.c | 2 +- tests/nwfilterxml2ebipfirewalltest.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfil= ter_ebiptables_driver.c index 6b6b3cbd69..fbc131ea9d 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -3015,7 +3015,7 @@ static void iptablesCreateChainsAndRules(virFirewall = *fw, virFirewallAddCmdFull(fw, layer, false, iptablesHandleCreateChainAndRules, (void *)cbdata, - "-L", NULL, NULL); + "-n", "-L", NULL, NULL); } =20 =20 diff --git a/tests/nwfilterxml2ebipfirewalltest.c b/tests/nwfilterxml2ebipf= irewalltest.c index b5a89f4fb1..931b987477 100644 --- a/tests/nwfilterxml2ebipfirewalltest.c +++ b/tests/nwfilterxml2ebipfirewalltest.c @@ -68,8 +68,8 @@ static const char *commonRules[] =3D { "ebtables \\\n--concurrent \\\n-t nat \\\n-N libvirt-P-vnet0\n", =20 /* Querying existence of rules */ - "iptables \\\n-w \\\n-L\n", - "ip6tables \\\n-w \\\n-L\n", + "iptables \\\n-w \\\n-n \\\n-L\n", + "ip6tables \\\n-w \\\n-n \\\n-L\n", =20 /* Inserting ebtables rules */ "ebtables \\\n--concurrent \\\n-t nat \\\n-A PREROUTING \\\n-i vnet0 \= \\n-j libvirt-J-vnet0\n" @@ -360,7 +360,7 @@ testCommandDryRunCallback(const char *const*args, } =20 /* simulate an empty existing set rules */ - if (STREQ(args[1], "-w") && STREQ(args[2], "-L")) { + if (STREQ(args[1], "-w") && STREQ(args[2], "-n") && STREQ(args[3], "-L= ")) { *output =3D g_strdup("Chain nothing\n"); *status =3D EXIT_SUCCESS; } --=20 2.56.0