A user reports that:
nft -f ruleset.nft
fails with:
netlink: Error: Could not process rule: No buffer space available
This was triggered by:
table ip6 fule {
set domestic_ip6 {
type ipv6_addr
flags dynamic,interval
elements = $domestic_ip6
}
chain prerouting {
type filter hook prerouting priority 0;
ip6 daddr @domestic_ip6 counter
}
}
where $domestic_ip6 contains a large number of IPv6 addresses.
This set declaration is not supported currently, because dynamic sets
with intervals are not supported, then every IPv6 address that is added
triggers an error, overruning the userspace socket buffer with lots of
NLMSG_ERROR messages.
In the particular context of batch processing, ENOBUFS is just an
indication that too many errors have occurred. The kernel cannot store
any more NLMSG_ERROR messages into the userspace socket buffer.
However, there are still NLMSG_ERROR messages in the socket buffer to be
processed that can provide a hint on what is going on.
Instead of breaking on ENOBUFS in batches, continue error processing.
After this patch, the ruleset above displays:
ruleset.nft:2367:7-18: Error: Could not process rule: Operation not supported
set domestic_ip6 {
^^^^^^^^^^^^
ruleset.nft:2367:7-18: Error: Could not process rule: No such file or directory
set domestic_ip6 {
^^^^^^^^^^^^
Fixes: a72315d2bad4 ("src: add rule batching support")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
---
src/mnl.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/mnl.c b/src/mnl.c
index 6684029606e5..4595b5aea11d 100644
--- a/src/mnl.c
+++ b/src/mnl.c
@@ -449,8 +449,11 @@ int mnl_batch_talk(struct netlink_ctx *ctx, struct list_head *err_list,
break;
ret = mnl_socket_recvfrom(nl, rcv_buf, sizeof(rcv_buf));
- if (ret == -1)
- return -1;
+ if (ret == -1) {
+ /* Too many errors, not all errors are displayed. */
+ if (errno != ENOBUFS)
+ return -1;
+ }
/* Continue on error, make sure we get all acknowledgments */
ret = mnl_cb_run2(rcv_buf, ret, 0, portid,
--
2.30.2
