From: Alexandre Derumier <aderumier@odiso.com>
Date: Mon, 26 May 2014 08:44:55 +0000 (+0200)
Subject: optimize blacklist : create a PVEFW-blacklist chain
X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=commitdiff_plain;h=b5831a0de803b061125811e53d6426f4340380ec

optimize blacklist : create a PVEFW-blacklist chain

currently we check the ipset blacklist twice (1 for log and 1 for drop)

It's better to check ipset once, and go to a PVEFW-blacklist chain
where we do the log, and then the drop

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
---

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index aa7de7e..df19a6c 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1544,8 +1544,12 @@ sub ruleset_chain_add_input_filters {
     my ($ruleset, $chain, $options, $cluster_conf, $loglevel) = @_;
 
     if ($cluster_conf->{ipset}->{blacklist}){
-	ruleset_addlog($ruleset, $chain, 0, "DROP: ", $loglevel, "-m set --match-set PVEFW-blacklist src");
-	ruleset_addrule($ruleset, $chain, "-m set --match-set PVEFW-blacklist src -j DROP");
+	if (!ruleset_chain_exist($ruleset, "PVEFW-blacklist")) {
+	    ruleset_create_chain($ruleset, "PVEFW-blacklist");
+	    ruleset_addlog($ruleset, "PVEFW-blacklist", 0, "DROP: ", $loglevel) if $loglevel;
+	    ruleset_addrule($ruleset, "PVEFW-blacklist", "-j DROP");
+	}
+	ruleset_addrule($ruleset, $chain, "-m set --match-set PVEFW-blacklist src -j PVEFW-blacklist");
     }
 
     if (!(defined($options->{nosmurfs}) && $options->{nosmurfs} == 0)) {