netfilter: nf_tables: store and dump set policy
authorArturo Borrero <arturo.borrero.glez@gmail.com>
Tue, 23 Sep 2014 11:30:41 +0000 (13:30 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 29 Sep 2014 09:28:03 +0000 (11:28 +0200)
We want to know in which cases the user explicitly sets the policy
options. In that case, we also want to dump back the info.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/net/netfilter/nf_tables.h
net/netfilter/nf_tables_api.c

index c4d86198d3d6542088ed6db8d4daed2adf191806..3d7292392fac91ca806b12945fd9eb190c21a031 100644 (file)
@@ -241,6 +241,7 @@ void nft_unregister_set(struct nft_set_ops *ops);
  *     @dtype: data type (verdict or numeric type defined by userspace)
  *     @size: maximum set size
  *     @nelems: number of elements
+ *     @policy: set parameterization (see enum nft_set_policies)
  *     @ops: set ops
  *     @flags: set flags
  *     @klen: key length
@@ -255,6 +256,7 @@ struct nft_set {
        u32                             dtype;
        u32                             size;
        u32                             nelems;
+       u16                             policy;
        /* runtime data below here */
        const struct nft_set_ops        *ops ____cacheline_aligned;
        u16                             flags;
index a476b99621551e8bb27aa06b9d67878c3ab4a43f..19e79f0d9ad25f121c8860f07e012a96ba0af528 100644 (file)
@@ -2344,6 +2344,11 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
                        goto nla_put_failure;
        }
 
+       if (set->policy != NFT_SET_POL_PERFORMANCE) {
+               if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
+                       goto nla_put_failure;
+       }
+
        desc = nla_nest_start(skb, NFTA_SET_DESC);
        if (desc == NULL)
                goto nla_put_failure;
@@ -2669,6 +2674,7 @@ static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb,
        set->dlen  = desc.dlen;
        set->flags = flags;
        set->size  = desc.size;
+       set->policy = policy;
 
        err = ops->init(set, &desc, nla);
        if (err < 0)