• Pablo Neira Ayuso's avatar
    netfilter: nfnetlink: deliver netlink errors on batch completion · cbb8125e
    Pablo Neira Ayuso authored
    We have to wait until the full batch has been processed to deliver the
    netlink error messages to userspace. Otherwise, we may deliver
    duplicated errors to userspace in case that we need to abort and replay
    the transaction if any of the required modules needs to be autoloaded.
    
    A simple way to reproduce this (assumming nft_meta is not loaded) with
    the following test file:
    
     add table filter
     add chain filter test
     add chain bad test                 # intentional wrong unexistent table
     add rule filter test meta mark 0
    
    Then, when trying to load the batch:
    
     # nft -f test
     test:4:1-19: Error: Could not process rule: No such file or directory
     add chain bad test
     ^^^^^^^^^^^^^^^^^^^
     test:4:1-19: Error: Could not process rule: No such file or directory
     add chain bad test
     ^^^^^^^^^^^^^^^^^^^
    
    The error is reported twice, once when the batch is aborted due to
    missing nft_meta and another when it is fully processed.
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    cbb8125e
nfnetlink.c 12.6 KB