]> www.infradead.org Git - users/jedix/linux-maple.git/commit
netfilter: nf_tables: prepare nft audit for set element compaction
authorFlorian Westphal <fw@strlen.de>
Wed, 13 Nov 2024 15:35:51 +0000 (16:35 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Thu, 14 Nov 2024 11:40:55 +0000 (12:40 +0100)
commit466c9b3b2a92602360e9fa25943b8aa191122dfc
tree02ae26cccca5c10a0afa67a0722777779b28790c
parenta8ee6b900c147d3bedced6c52ba6cb603226aaa3
netfilter: nf_tables: prepare nft audit for set element compaction

nftables audit log format emits the number of added/deleted rules, sets,
set elements and so on, to userspace:

    table=t1 family=2 entries=4 op=nft_register_set
                      ~~~~~~~~~

At this time, the 'entries' key is the number of transactions that will
be applied.

The upcoming set element compression will coalesce subsequent
adds/deletes to the same set requests in the same transaction
request to conseve memory.

Without this patch, we'd under-report the number of altered elements.

Increment the audit counter by the number of elements to keep the reported
entries value the same.

Without this, nft_audit.sh selftest fails because the recorded
(expected) entries key is smaller than the expected one.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_tables_api.c