diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-07-22 22:16:59 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-07-25 03:41:17 +0200 |
commit | e2b60d54ab2f580cb4aef5a01c7b36a02aee6cc6 (patch) | |
tree | 5922119e9a279d4091dd5c56da58cc3ca7c05bbe /src/mnl.c | |
parent | fd3479639d0a43399a15995add9d4abbcf40f22c (diff) |
mnl: introduce NFT_NLMSG_MAXSIZE
The NFT_NLMSG_MAXSIZE constant defines the maximum nf_tables netlink
message. Currently, the largest is the set element message, which
contains the NFTA_SET_ELEM_LIST_ELEMENTS attribute. This attribute is
a nest that describes the set elements. Given that the netlink attribute
length (nla_len) is 16 bits, the largest message is a bit larger than
64 KBytes. Thus, the proposed value of NFT_NLMSG_MAXSIZE is set to
(1 << 16) + getpagesize().
This new constant is used to calculate the length of:
1) the batch page length, when the batching mode is used.
2) the buffer that stores the netlink message in the send (when no
batching is used) and receive paths.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/mnl.c')
-rw-r--r-- | src/mnl.c | 18 |
1 files changed, 13 insertions, 5 deletions
@@ -33,11 +33,19 @@ uint32_t mnl_seqnum_alloc(void) return seq++; } +/* The largest nf_tables netlink message is the set element message, which + * contains the NFTA_SET_ELEM_LIST_ELEMENTS attribute. This attribute is + * a nest that describes the set elements. Given that the netlink attribute + * length (nla_len) is 16 bits, the largest message is a bit larger than + * 64 KBytes. + */ +#define NFT_NLMSG_MAXSIZE (UINT16_MAX + getpagesize()) + static int nft_mnl_recv(struct mnl_socket *nf_sock, uint32_t seqnum, uint32_t portid, int (*cb)(const struct nlmsghdr *nlh, void *data), void *cb_data) { - char buf[MNL_SOCKET_BUFFER_SIZE]; + char buf[NFT_NLMSG_MAXSIZE]; int ret; ret = mnl_socket_recvfrom(nf_sock, buf, sizeof(buf)); @@ -86,8 +94,8 @@ static struct mnl_nlmsg_batch *mnl_batch_alloc(void) { static char *buf; - /* libmnl needs higher buffer to handle batch overflows */ - buf = xmalloc(BATCH_PAGE_SIZE + getpagesize()); + /* libmnl needs higher buffer to handle batch overflows. */ + buf = xmalloc(BATCH_PAGE_SIZE + NFT_NLMSG_MAXSIZE); return mnl_nlmsg_batch_start(buf, BATCH_PAGE_SIZE); } @@ -818,7 +826,7 @@ int mnl_nft_set_get(struct mnl_socket *nf_sock, struct nft_set *nls) int mnl_nft_setelem_add(struct mnl_socket *nf_sock, struct nft_set *nls, unsigned int flags) { - char buf[MNL_SOCKET_BUFFER_SIZE]; + char buf[NFT_NLMSG_MAXSIZE]; struct nlmsghdr *nlh; nlh = nft_set_elem_nlmsg_build_hdr(buf, NFT_MSG_NEWSETELEM, @@ -832,7 +840,7 @@ int mnl_nft_setelem_add(struct mnl_socket *nf_sock, struct nft_set *nls, int mnl_nft_setelem_delete(struct mnl_socket *nf_sock, struct nft_set *nls, unsigned int flags) { - char buf[MNL_SOCKET_BUFFER_SIZE]; + char buf[NFT_NLMSG_MAXSIZE]; struct nlmsghdr *nlh; nlh = nft_set_elem_nlmsg_build_hdr(buf, NFT_MSG_DELSETELEM, |