|
 |
3a00e5 |
From 663151585d25996baee985b9b77b58627de16531 Mon Sep 17 00:00:00 2001
|
|
|
3a00e5 |
From: Phil Sutter <phil@nwl.cc>
|
|
|
3a00e5 |
Date: Tue, 6 Apr 2021 10:51:20 +0200
|
|
|
3a00e5 |
Subject: [PATCH] nft: Increase BATCH_PAGE_SIZE to support huge rulesets
|
|
|
3a00e5 |
|
|
|
3a00e5 |
In order to support the same ruleset sizes as legacy iptables, the
|
|
|
3a00e5 |
kernel's limit of 1024 iovecs has to be overcome. Therefore increase
|
|
|
3a00e5 |
each iovec's size from 128KB to 2MB.
|
|
|
3a00e5 |
|
|
|
3a00e5 |
While being at it, add a log message for failing sendmsg() call. This is
|
|
|
3a00e5 |
not supposed to happen, even if the transaction fails. Yet if it does,
|
|
|
3a00e5 |
users are left with only a "line XXX failed" message (with line number
|
|
|
3a00e5 |
being the COMMIT line).
|
|
|
3a00e5 |
|
|
|
3a00e5 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
3a00e5 |
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
|
3a00e5 |
(cherry picked from commit a3e81c62e8c5abb4158f1f66df6bbcffd1b33240)
|
|
|
3a00e5 |
---
|
|
|
3a00e5 |
iptables/nft.c | 12 +++++++-----
|
|
|
3a00e5 |
1 file changed, 7 insertions(+), 5 deletions(-)
|
|
|
3a00e5 |
|
|
|
3a00e5 |
diff --git a/iptables/nft.c b/iptables/nft.c
|
|
|
3a00e5 |
index 8b14daeaed610..f1deb82f87576 100644
|
|
|
3a00e5 |
--- a/iptables/nft.c
|
|
|
3a00e5 |
+++ b/iptables/nft.c
|
|
|
3a00e5 |
@@ -88,11 +88,11 @@ int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh,
|
|
|
3a00e5 |
|
|
|
3a00e5 |
#define NFT_NLMSG_MAXSIZE (UINT16_MAX + getpagesize())
|
|
|
3a00e5 |
|
|
|
3a00e5 |
-/* selected batch page is 256 Kbytes long to load ruleset of
|
|
|
3a00e5 |
- * half a million rules without hitting -EMSGSIZE due to large
|
|
|
3a00e5 |
- * iovec.
|
|
|
3a00e5 |
+/* Selected batch page is 2 Mbytes long to support loading a ruleset of 3.5M
|
|
|
3a00e5 |
+ * rules matching on source and destination address as well as input and output
|
|
|
3a00e5 |
+ * interfaces. This is what legacy iptables supports.
|
|
|
3a00e5 |
*/
|
|
|
3a00e5 |
-#define BATCH_PAGE_SIZE getpagesize() * 32
|
|
|
3a00e5 |
+#define BATCH_PAGE_SIZE 2 * 1024 * 1024
|
|
|
3a00e5 |
|
|
|
3a00e5 |
static struct nftnl_batch *mnl_batch_init(void)
|
|
|
3a00e5 |
{
|
|
|
3a00e5 |
@@ -220,8 +220,10 @@ static int mnl_batch_talk(struct nft_handle *h, int numcmds)
|
|
|
3a00e5 |
int err = 0;
|
|
|
3a00e5 |
|
|
|
3a00e5 |
ret = mnl_nft_socket_sendmsg(h, numcmds);
|
|
|
3a00e5 |
- if (ret == -1)
|
|
|
3a00e5 |
+ if (ret == -1) {
|
|
|
3a00e5 |
+ fprintf(stderr, "sendmsg() failed: %s\n", strerror(errno));
|
|
|
3a00e5 |
return -1;
|
|
|
3a00e5 |
+ }
|
|
|
3a00e5 |
|
|
|
3a00e5 |
FD_ZERO(&readfds);
|
|
|
3a00e5 |
FD_SET(fd, &readfds);
|
|
|
3a00e5 |
--
|
|
|
3a00e5 |
2.31.1
|
|
|
3a00e5 |
|