[PATCH nft 1/2] netlink: flush stdout after each event in monitor mode

[PATCH nft 1/2] netlink: flush stdout after each event in monitor mode

[Pablo Neira Ayuso]

So we get all events when redirecting them to file, ie.

	# nftables monitor > file

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/netlink.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/src/netlink.c b/src/netlink.c
index a905009..4371c0a 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -2143,6 +2143,7 @@ static int netlink_events_cb(const struct nlmsghdr *nlh, void *data)
 		ret = netlink_events_rule_cb(nlh, type, monh);
 		break;
 	}
+	fflush(stdout);
 
 	return ret;
 }
-- 
1.7.10.4

[PATCH nft 2/2] mnl: rework netlink socket event receive path

[Pablo Neira Ayuso]

This patch reworks two aspects of the netlink socket event receive path:

1) In case of ENOBUFS, stay in the loop to keep receiving messages. The tool
   displays a message so the user knows that we got lost event messages.

2) Rise the default size of the receive socket buffer up to 16 MBytes to reduce
   chances of hitting ENOBUFS. Asumming that the netlink event message size is
   ~150 bytes, we can bear with ~111848 rules without message loss.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/mnl.c |   38 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 37 insertions(+), 1 deletion(-)

diff --git a/src/mnl.c b/src/mnl.c
index 76a9714..4795706 100644
--- a/src/mnl.c
+++ b/src/mnl.c
@@ -23,6 +23,7 @@
 
 #include <mnl.h>
 #include <string.h>
+#include <sys/socket.h>
 #include <arpa/inet.h>
 #include <errno.h>
 #include <utils.h>
@@ -966,11 +967,46 @@ err:
 /*
  * events
  */
+#define NFTABLES_NLEVENT_BUFSIZ	(1 << 24)
+
 int mnl_nft_event_listener(struct mnl_socket *nf_sock,
 			   int (*cb)(const struct nlmsghdr *nlh, void *data),
 			   void *cb_data)
 {
-	return nft_mnl_recv(nf_sock, 0, 0, cb, cb_data);
+	/* Set netlink socket buffer size to 16 Mbytes to reduce chances of
+ 	 * message loss due to ENOBUFS.
+	 */
+	unsigned int bufsiz = NFTABLES_NLEVENT_BUFSIZ;
+	char buf[NFT_NLMSG_MAXSIZE];
+	int ret;
+
+	ret = setsockopt(mnl_socket_get_fd(nf_sock), SOL_SOCKET, SO_RCVBUFFORCE,
+			 &bufsiz, sizeof(socklen_t));
+        if (ret < 0) {
+		/* If this doesn't work, try to reach the system wide maximum
+		 * (or whatever the user requested).
+		 */
+                ret = setsockopt(mnl_socket_get_fd(nf_sock), SOL_SOCKET,
+				 SO_RCVBUF, &bufsiz, sizeof(socklen_t));
+		printf("# Cannot set up netlink socket buffer size to %u bytes, falling back to %u bytes\n",
+		       NFTABLES_NLEVENT_BUFSIZ, bufsiz);
+	}
+
+	while (1) {
+		ret = mnl_socket_recvfrom(nf_sock, buf, sizeof(buf));
+		if (ret < 0) {
+			if (errno == ENOBUFS) {
+				printf("# ERROR: We lost some netlink events!\n");
+				continue;
+			}
+			fprintf(stdout, "# ERROR: %s\n", strerror(errno));
+			break;
+		}
+		ret = mnl_cb_run(buf, ret, 0, 0, cb, cb_data);
+		if (ret <= 0)
+			break;
+	}
+	return ret;
 }
 
 static void nft_mnl_batch_put(char *buf, uint16_t type, uint32_t seq)
-- 
1.7.10.4