Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9363dc4b authored by Arturo Borrero's avatar Arturo Borrero Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: store and dump set policy 



We want to know in which cases the user explicitly sets the policy
options. In that case, we also want to dump back the info.

Signed-off-by: default avatarArturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 34666d46

include/net/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -241,6 +241,7 @@ void nft_unregister_set(struct nft_set_ops *ops); 
 * 	@dtype: data type (verdict or numeric type defined by userspace)

 * 	@size: maximum set size

 * 	@nelems: number of elements

 *	@policy: set parameterization (see enum nft_set_policies)

 * 	@ops: set ops

 * 	@flags: set flags

 * 	@klen: key length
@@ -255,6 +256,7 @@ struct nft_set { 
	u32				dtype;

	u32				size;

	u32				nelems;

	u16				policy;

	/* runtime data below here */

	const struct nft_set_ops	*ops ____cacheline_aligned;

	u16				flags;

net/netfilter/nf_tables_api.c

+6 −0
Original line number Diff line number Diff line
@@ -2344,6 +2344,11 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, 
			goto nla_put_failure;

	}



	if (set->policy != NFT_SET_POL_PERFORMANCE) {

		if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))

			goto nla_put_failure;

	}



	desc = nla_nest_start(skb, NFTA_SET_DESC);

	if (desc == NULL)

		goto nla_put_failure;
@@ -2669,6 +2674,7 @@ static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb, 
	set->dlen  = desc.dlen;

	set->flags = flags;

	set->size  = desc.size;

	set->policy = policy;



	err = ops->init(set, &desc, nla);

	if (err < 0)