Phil Sutter <phil@xxxxxx> wrote:
> In order to support the same ruleset sizes as legacy iptables, the
> kernel's limit of 1024 iovecs has to be overcome. Therefore increase
> each iovec's size from 256KB to 4MB.
>
> While being at it, add a log message for failing sendmsg() call. This is
> not supposed to happen, even if the transaction fails. Yet if it does,
> users are left with only a "line XXX failed" message (with line number
> being the COMMIT line).
>
> Signed-off-by: Phil Sutter <phil@xxxxxx>
> ---
> iptables/nft.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/iptables/nft.c b/iptables/nft.c
> index bd840e75f83f4..e19c88ece6c2a 100644
> --- a/iptables/nft.c
> +++ b/iptables/nft.c
> @@ -88,11 +88,11 @@ int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh,
>
> #define NFT_NLMSG_MAXSIZE (UINT16_MAX + getpagesize())
>
> -/* selected batch page is 256 Kbytes long to load ruleset of
> - * half a million rules without hitting -EMSGSIZE due to large
> - * iovec.
> +/* Selected batch page is 4 Mbytes long to support loading a ruleset of 3.5M
> + * rules matching on source and destination address as well as input and output
> + * interfaces. This is what legacy iptables supports.
> */
> -#define BATCH_PAGE_SIZE getpagesize() * 32
> +#define BATCH_PAGE_SIZE getpagesize() * 512
Why not remove getpagesize() altogether?
The comment assumes getpagesize returns 4096 so might as well just use
"#define BATCH_PAGE_SIZE (4 * 1024 * 1024)" or similar?
On my system getpagesize() * 512 yields 2097152 ...
> static struct nftnl_batch *mnl_batch_init(void)
> {
> @@ -220,8 +220,10 @@ static int mnl_batch_talk(struct nft_handle *h, int numcmds)
> int err = 0;
>
> ret = mnl_nft_socket_sendmsg(h, numcmds);
> - if (ret == -1)
> + if (ret == -1) {
> + fprintf(stderr, "sendmsg() failed: %s\n", strerror(errno));
> return -1;
> + }
Isn't that library code? At the very least this should use
nft_print().
