netfilter: nf_tables: store and dump set policy

We want to know in which cases the user explicitly sets the policy
options. In that case, we also want to dump back the info.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index c4d86198d3d6542088ed6db8d4daed2adf191806..3d7292392fac91ca806b12945fd9eb190c21a031 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -241,6 +241,7 @@ void nft_unregister_set(struct nft_set_ops *ops);
  *     @dtype: data type (verdict or numeric type defined by userspace)
  *     @size: maximum set size
  *     @nelems: number of elements
+ *     @policy: set parameterization (see enum nft_set_policies)
  *     @ops: set ops
  *     @flags: set flags
  *     @klen: key length
@@ -255,6 +256,7 @@ struct nft_set {
        u32                             dtype;
        u32                             size;
        u32                             nelems;
+       u16                             policy;
        /* runtime data below here */
        const struct nft_set_ops        *ops ____cacheline_aligned;
        u16                             flags;

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index a476b99621551e8bb27aa06b9d67878c3ab4a43f..19e79f0d9ad25f121c8860f07e012a96ba0af528 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2344,6 +2344,11 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
                        goto nla_put_failure;
        }
 
+       if (set->policy != NFT_SET_POL_PERFORMANCE) {
+               if (nla_put_be32(skb, NFTA_SET_POLICY, htonl(set->policy)))
+                       goto nla_put_failure;
+       }
+
        desc = nla_nest_start(skb, NFTA_SET_DESC);
        if (desc == NULL)
                goto nla_put_failure;
@@ -2669,6 +2674,7 @@ static int nf_tables_newset(struct sock *nlsk, struct sk_buff *skb,
        set->dlen  = desc.dlen;
        set->flags = flags;
        set->size  = desc.size;
+       set->policy = policy;
 
        err = ops->init(set, &desc, nla);
        if (err < 0)