SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: Open netfilter socket only when needed

Browse Source 
On initrds where nfnetlink module is missing, trying to open
a NETLINK_NETFILTER netlink socket takes a lot of time then fails.
This makes boot noticibly slower. Even though probably no
unit in an initrd need netfilter.

So here we delay opening the socket until we know we need it.
This commit is contained in:
Valentin David
2026-05-04 15:25:03 +01:00
committed by Luca Boccassi
parent 7e6507c43f
commit 4a11c5edeb
2 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/cgroup.c
+6 -6
View File
@@ -1293,18 +1293,18 @@ static void unit_modify_nft_set(Unit *u, bool add) {
if (!crt || crt->cgroup_id == 0)
return;
if (!u->manager->nfnl) {
r = sd_nfnl_socket_open(&u->manager->nfnl);
if (r < 0)
return;
}
CGroupContext *c = ASSERT_PTR(unit_get_cgroup_context(u));
FOREACH_ARRAY(nft_set, c->nft_set_context.sets, c->nft_set_context.n_sets) {
if (nft_set->source != NFT_SET_SOURCE_CGROUP)
continue;
if (!u->manager->nfnl) {
r = sd_nfnl_socket_open(&u->manager->nfnl);
if (r < 0)
return (void) log_once_errno(LOG_WARNING, r, "Failed to open NETLINK_NETFILTER socket, ignoring: %m");
}
uint64_t element = crt->cgroup_id;
r = nft_set_element_modify_any(u->manager->nfnl, add, nft_set->nfproto, nft_set->table, nft_set->set, &element, sizeof(element));
src/core/unit.c
+6 -6
View File
@@ -5393,16 +5393,16 @@ static void unit_modify_user_nft_set(Unit *u, bool add, NFTSetSource source, uin
if (!c)
return;
if (!u->manager->nfnl) {
r = sd_nfnl_socket_open(&u->manager->nfnl);
if (r < 0)
return;
}
FOREACH_ARRAY(nft_set, c->nft_set_context.sets, c->nft_set_context.n_sets) {
if (nft_set->source != source)
continue;
if (!u->manager->nfnl) {
r = sd_nfnl_socket_open(&u->manager->nfnl);
if (r < 0)
return (void) log_once_errno(LOG_WARNING, r, "Failed to open NETLINK_NETFILTER socket, ignoring: %m");
}
r = nft_set_element_modify_any(u->manager->nfnl, add, nft_set->nfproto, nft_set->table, nft_set->set, &element, sizeof(element));
if (r < 0)
log_warning_errno(r, "Failed to %s NFT set entry: family %s, table %s, set %s, ID %u, ignoring: %m",