Page MenuHomeVyOS Platform

Adding firewall port ranges makes commit/boot MASSIVELY slow
Open, LowPublic

Description

As of this commit, every port is checked with an exec(ipset -T):

https://github.com/vyos/vyatta-cfg-firewall/commit/835304e5aaa252e8b0bcf4651629cd089e670147

If there is a large port range, this can take many many minutes. A simple example would be

conf
set firewall group port-group slowwwwww port '20000-65531'
commit

That would run ipset -T 45,531 times.

A better idea is to get the ipset result BEFORE the check, and then iterate over the result to see if anything is missing.

Details

Difficulty level
Unknown (require assessment)
Version
VyOS 1.3-beta-202111232035
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Behavior change
Issue type
Improvement (missing useful functionality)

Event Timeline

xrobau created this task.
xrobau created this object in space S1 VyOS Public.