From b5831a0de803b061125811e53d6426f4340380ec Mon Sep 17 00:00:00 2001 From: Alexandre Derumier Date: Mon, 26 May 2014 10:44:55 +0200 Subject: [PATCH] optimize blacklist : create a PVEFW-blacklist chain currently we check the ipset blacklist twice (1 for log and 1 for drop) It's better to check ipset once, and go to a PVEFW-blacklist chain where we do the log, and then the drop Signed-off-by: Alexandre Derumier --- src/PVE/Firewall.pm | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index aa7de7e..df19a6c 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -1544,8 +1544,12 @@ sub ruleset_chain_add_input_filters { my ($ruleset, $chain, $options, $cluster_conf, $loglevel) = @_; if ($cluster_conf->{ipset}->{blacklist}){ - ruleset_addlog($ruleset, $chain, 0, "DROP: ", $loglevel, "-m set --match-set PVEFW-blacklist src"); - ruleset_addrule($ruleset, $chain, "-m set --match-set PVEFW-blacklist src -j DROP"); + if (!ruleset_chain_exist($ruleset, "PVEFW-blacklist")) { + ruleset_create_chain($ruleset, "PVEFW-blacklist"); + ruleset_addlog($ruleset, "PVEFW-blacklist", 0, "DROP: ", $loglevel) if $loglevel; + ruleset_addrule($ruleset, "PVEFW-blacklist", "-j DROP"); + } + ruleset_addrule($ruleset, $chain, "-m set --match-set PVEFW-blacklist src -j PVEFW-blacklist"); } if (!(defined($options->{nosmurfs}) && $options->{nosmurfs} == 0)) { -- 2.39.2