Skip to content

Commit

Permalink
bridge, spoof check: remove drop rule index
Browse files Browse the repository at this point in the history
Rules are appendend by default, thus using an index is redundant.
Using an index also requires the full NFT cache, which causes a CNI ADD
to be extremely slow.

Signed-off-by: Miguel Duarte Barroso <mdbarroso@redhat.com>
  • Loading branch information
maiqueb committed Apr 4, 2023
1 parent 63235a2 commit f117c7c
Showing 1 changed file with 0 additions and 2 deletions.
2 changes: 0 additions & 2 deletions pkg/link/spoofcheck.go
Original file line number Diff line number Diff line change
Expand Up @@ -195,12 +195,10 @@ func (sc *SpoofChecker) matchMacRule(chain string) *schema.Rule {
}

func (sc *SpoofChecker) dropRule(chain string) *schema.Rule {
macRulesIndex := nft.NewRuleIndex()
return &schema.Rule{
Family: schema.FamilyBridge,
Table: natTableName,
Chain: chain,
Index: macRulesIndex.Next(),
Expr: []schema.Statement{
{Verdict: schema.Verdict{SimpleVerdict: schema.SimpleVerdict{Drop: true}}},
},
Expand Down

0 comments on commit f117c7c

Please sign in to comment.