search for: nft_netlink

...OS: All Status: NEW Severity: enhancement Priority: P5 Component: nft Assignee: pablo at netfilter.org Reporter: makovick at gmail.com Created attachment 592 --> https://bugzilla.netfilter.org/attachment.cgi?id=592&action=edit nft_netlink error path speedup patch When nft_netlink() encounters an error, it looks up the offending command in the command list, always starting from the list head. With long machine generated nftables containing errors, this can take a very long time, making an impression that nft locked up. Because the...

...ec31ce3 in do_list_ruleset (ctx=0x7fff2a98d110, cmd=0x55637f6ec290) at rule.c:2405 #13 0x00007f30cec32289 in do_command_list (ctx=0x7fff2a98d110, cmd=0x55637f6ec290) at rule.c:2527 #14 0x00007f30cec32bc4 in do_command (ctx=0x7fff2a98d110, cmd=0x55637f6ec290) at rule.c:2753 #15 0x00007f30cec6faf5 in nft_netlink (nft=0x55637f6e52a0, cmds=0x7fff2a98d1c0, msgs=0x7fff2a98d1b0, nf_sock=0x55637f6e5f30) at libnftables.c:42 #16 0x00007f30cec70c81 in nft_run_cmd_from_filename (nft=0x55637f6e52a0, filename=0x7fff2a98eb59 "a.nft") at libnftables.c:512 #17 0x000055637e892f41 in main (argc=4, argv=0x7fff2a98...

...../../nftables/src/rule.c:2208 #7 0x00007fc1b9afe5bc in do_command_list (ctx=0x7ffc919cdfe0, cmd=0x561fc75ec500) at ../../../nftables/src/rule.c:2330 #8 0x00007fc1b9afef56 in do_command (ctx=0x7ffc919cdfe0, cmd=0x561fc75ec500) at ../../../nftables/src/rule.c:2572 #9 0x00007fc1b9b363e2 in nft_netlink (nft=0x561fc75eb2a0, cmds=0x7ffc919ce090, msgs=0x7ffc919ce080, nf_sock=0x561fc75ebc30) at ../../../nftables/src/libnftables.c:42 #10 0x00007fc1b9b3754a in nft_run_cmd_from_filename (nft=0x561fc75eb2a0, filename=0x7ffc919cecff "./nft.ruleset") at ../../../nftables/src/libnftables.c...

...ffffffe3a0) at src/rule.c:609 #6 do_command_add (ctx=ctx at entry=0x7fffffffe3a0, cmd=cmd at entry=0x6518a0, excl=excl at entry=false) at src/rule.c:625 #7 0x0000000000407eea in do_command (ctx=ctx at entry=0x7fffffffe3a0, cmd=cmd at entry=0x6518a0) at src/rule.c:914 #8 0x0000000000406426 in nft_netlink (msgs=0x7fffffffe430, state=0x7fffffffe440) at src/main.c:183 #9 nft_run (scanner=scanner at entry=0x645390, state=state at entry=0x7fffffffe440, msgs=msgs at entry=0x7fffffffe430) at src/main.c:227 #10 0x0000000000405fca in main (argc=3, argv=<optimized out>) at src/main.c:340 # Loading a...

...h=0x5600a2fdcaf0, ctx=0x7fff364093e0) at rule.c:1015 #6 do_command_add (ctx=0x7fff364093e0, cmd=0x5600a2fdcab0, excl=excl at entry=false) at rule.c:1054 #7 0x00005600a1c967a7 in do_command (ctx=ctx at entry=0x7fff364093e0, cmd=cmd at entry=0x5600a2fdcab0) at rule.c:1805 #8 0x00005600a1c810e5 in nft_netlink (nf_sock=0x5600a2fdbb50, msgs=0x7fff36409490, state=0x7fff364094a0, nft=0x5600a2fdba20) at libnftables.c:47 #9 nft_run (nft=nft at entry=0x5600a2fdba20, nf_sock=0x5600a2fdbb50, scanner=scanner at entry=0x5600a2fdbb90, state=state at entry=0x7fff364094a0, msgs=msgs at entry=0x7fff36409490)...

...= <optimized out> monhandler = {monitor_flags = 131437, format = 0, ctx = 0x3cc19177c70, loc = 0x47a8a0c4e0, cache_needed = true} #10 do_command (ctx=0x3cc19177c70, cmd=<optimized out>) at rule.c:1358 __PRETTY_FUNCTION__ = "do_command" #11 0x00000047a69f657a in nft_netlink (msgs=0x3cc19177d10, state=0x3cc19177d20) at main.c:194 ctx = {msgs = 0x3cc19177d10, list = {next = 0x3cc19177c78, prev = 0x3cc19177c78}, set = 0x0, data = 0x47a8a0c910, seqnum = 4, batch_supported = true} err = <optimized out> tmp = <optimized out> err_l...

...y=0x7fffffffde10, cb_ctl_array=0x55555560a5a0 <cb_ctl_array>, cb_ctl_array_len=16) at callback.c:135 #17 0x00005555555b1aac in mnl_batch_talk (ctx=ctx at entry=0x7fffffffdf70, err_list=err_list at entry=0x7fffffffdf60, num_cmds=num_cmds at entry=161) at mnl.c:433 #18 0x000055555556b6c5 in nft_netlink (nft=nft at entry=0x55555560c2a0, cmds=cmds at entry=0x7fffffffe010, msgs=msgs at entry=0x7fffffffe000, nf_sock=<optimized out>) at libnftables.c:57 #19 0x000055555556bfa8 in nft_run_cmd_from_filename (nft=0x55555560c2a0, filename=0x7fffffffe4ad "/etc/nftables/init.nft") at libnftab...

...ounter src: use cache infrastructure for chain objects evaluate: add cmd_evaluate_rename() src: add chain declarations to cache src: use cache infrastructure for rule objects src: use cache infrastructure for set element objects src: get rid of EINTR handling for nft_netlink() evaluate: display error on unexisting chain when listing netlink: don't call netlink_dump_*() from listing functions with --debug=netlink tests: sets: don't include listing in payload tests tests: redirect: fix payload display tests: display error when trying...