* [PATCH v2] netfilter: nft_numgen: add increment counter offset value
@ 2016-09-07 17:56 Laura Garcia Liebana
2016-09-12 16:45 ` Pablo Neira Ayuso
0 siblings, 1 reply; 5+ messages in thread
From: Laura Garcia Liebana @ 2016-09-07 17:56 UTC (permalink / raw)
To: netfilter-devel
Add support for an initialization counter value. With this option the
sysadmin is able to start the counter when used with the increment type.
Example:
meta mark set numgen inc mod 2 sum 100
This will generate marks with the serie 100, 101, 100, 101, ...
Only supported for increment number generation.
Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
---
Changes in v2:
- Separate _SUM_ changes with _until_ attribute renaming.
include/uapi/linux/netfilter/nf_tables.h | 2 ++
net/netfilter/nft_numgen.c | 9 +++++++--
2 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 24161e2..00a689d 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1128,12 +1128,14 @@ enum nft_trace_types {
* @NFTA_NG_DREG: destination register (NLA_U32)
* @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
* @NFTA_NG_TYPE: operation type (NLA_U32)
+ * @NFTA_NG_SUM: Offset to initiate the counter (NLA_U32)
*/
enum nft_ng_attributes {
NFTA_NG_UNSPEC,
NFTA_NG_DREG,
NFTA_NG_MODULUS,
NFTA_NG_TYPE,
+ NFTA_NG_SUM,
__NFTA_NG_MAX
};
#define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
index f51a3ed..a5ea3f7 100644
--- a/net/netfilter/nft_numgen.c
+++ b/net/netfilter/nft_numgen.c
@@ -44,6 +44,7 @@ static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
[NFTA_NG_DREG] = { .type = NLA_U32 },
[NFTA_NG_MODULUS] = { .type = NLA_U32 },
[NFTA_NG_TYPE] = { .type = NLA_U32 },
+ [NFTA_NG_SUM] = { .type = NLA_U32 },
};
static int nft_ng_inc_init(const struct nft_ctx *ctx,
@@ -51,13 +52,17 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
const struct nlattr * const tb[])
{
struct nft_ng_inc *priv = nft_expr_priv(expr);
+ u32 sum = 0;
+
+ if (tb[NFTA_NG_SUM])
+ sum = ntohl(nla_get_be32(tb[NFTA_NG_SUM]));
priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS]));
- if (priv->modulus == 0)
+ if (priv->modulus == 0 || sum >= priv->modulus)
return -ERANGE;
priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
- atomic_set(&priv->counter, 0);
+ atomic_set(&priv->counter, sum);
return nft_validate_register_store(ctx, priv->dreg, NULL,
NFT_DATA_VALUE, sizeof(u32));
--
2.8.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2] netfilter: nft_numgen: add increment counter offset value
2016-09-07 17:56 [PATCH v2] netfilter: nft_numgen: add increment counter offset value Laura Garcia Liebana
@ 2016-09-12 16:45 ` Pablo Neira Ayuso
2016-09-12 17:08 ` Laura Garcia
2016-09-12 17:25 ` Laura Garcia
0 siblings, 2 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2016-09-12 16:45 UTC (permalink / raw)
To: Laura Garcia Liebana; +Cc: netfilter-devel
On Wed, Sep 07, 2016 at 07:56:49PM +0200, Laura Garcia Liebana wrote:
> Add support for an initialization counter value. With this option the
> sysadmin is able to start the counter when used with the increment type.
>
> Example:
>
> meta mark set numgen inc mod 2 sum 100
>
> This will generate marks with the serie 100, 101, 100, 101, ...
>
> Only supported for increment number generation.
>
> Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
> ---
> Changes in v2:
> - Separate _SUM_ changes with _until_ attribute renaming.
>
> include/uapi/linux/netfilter/nf_tables.h | 2 ++
> net/netfilter/nft_numgen.c | 9 +++++++--
> 2 files changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index 24161e2..00a689d 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -1128,12 +1128,14 @@ enum nft_trace_types {
> * @NFTA_NG_DREG: destination register (NLA_U32)
> * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
> * @NFTA_NG_TYPE: operation type (NLA_U32)
> + * @NFTA_NG_SUM: Offset to initiate the counter (NLA_U32)
> */
> enum nft_ng_attributes {
> NFTA_NG_UNSPEC,
> NFTA_NG_DREG,
> NFTA_NG_MODULUS,
> NFTA_NG_TYPE,
> + NFTA_NG_SUM,
> __NFTA_NG_MAX
> };
> #define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
> diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
> index f51a3ed..a5ea3f7 100644
> --- a/net/netfilter/nft_numgen.c
> +++ b/net/netfilter/nft_numgen.c
> @@ -44,6 +44,7 @@ static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
> [NFTA_NG_DREG] = { .type = NLA_U32 },
> [NFTA_NG_MODULUS] = { .type = NLA_U32 },
> [NFTA_NG_TYPE] = { .type = NLA_U32 },
> + [NFTA_NG_SUM] = { .type = NLA_U32 },
> };
>
> static int nft_ng_inc_init(const struct nft_ctx *ctx,
> @@ -51,13 +52,17 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
> const struct nlattr * const tb[])
> {
> struct nft_ng_inc *priv = nft_expr_priv(expr);
> + u32 sum = 0;
> +
> + if (tb[NFTA_NG_SUM])
> + sum = ntohl(nla_get_be32(tb[NFTA_NG_SUM]));
>
> priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS]));
> - if (priv->modulus == 0)
> + if (priv->modulus == 0 || sum >= priv->modulus)
> return -ERANGE;
>
> priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
> - atomic_set(&priv->counter, 0);
> + atomic_set(&priv->counter, sum);
Are you sure this will work?
nval = (oval + 1 < priv->modulus) ? oval + 1 : 0;
This is just setting priv->counter to an initial value, then it will
become zero at some point.
I'm going to take Liping's patch that converts:
memcpy(®s->data[priv->dreg], &priv->counter, sizeof(u32));
to:
reg->data[priv->dreg] = nval;
so you can change this to:
reg->data[priv->dreg] = nval + priv->offset;
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] netfilter: nft_numgen: add increment counter offset value
2016-09-12 16:45 ` Pablo Neira Ayuso
@ 2016-09-12 17:08 ` Laura Garcia
2016-09-12 17:21 ` Pablo Neira Ayuso
2016-09-12 17:25 ` Laura Garcia
1 sibling, 1 reply; 5+ messages in thread
From: Laura Garcia @ 2016-09-12 17:08 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
On Mon, Sep 12, 2016 at 06:45:58PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Sep 07, 2016 at 07:56:49PM +0200, Laura Garcia Liebana wrote:
> > Add support for an initialization counter value. With this option the
> > sysadmin is able to start the counter when used with the increment type.
> >
> > Example:
> >
> > meta mark set numgen inc mod 2 sum 100
> >
> > This will generate marks with the serie 100, 101, 100, 101, ...
> >
> > Only supported for increment number generation.
> >
> > Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
> > ---
> > Changes in v2:
> > - Separate _SUM_ changes with _until_ attribute renaming.
> >
> > include/uapi/linux/netfilter/nf_tables.h | 2 ++
> > net/netfilter/nft_numgen.c | 9 +++++++--
> > 2 files changed, 9 insertions(+), 2 deletions(-)
> >
> > diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> > index 24161e2..00a689d 100644
> > --- a/include/uapi/linux/netfilter/nf_tables.h
> > +++ b/include/uapi/linux/netfilter/nf_tables.h
> > @@ -1128,12 +1128,14 @@ enum nft_trace_types {
> > * @NFTA_NG_DREG: destination register (NLA_U32)
> > * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
> > * @NFTA_NG_TYPE: operation type (NLA_U32)
> > + * @NFTA_NG_SUM: Offset to initiate the counter (NLA_U32)
> > */
> > enum nft_ng_attributes {
> > NFTA_NG_UNSPEC,
> > NFTA_NG_DREG,
> > NFTA_NG_MODULUS,
> > NFTA_NG_TYPE,
> > + NFTA_NG_SUM,
> > __NFTA_NG_MAX
> > };
> > #define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
> > diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
> > index f51a3ed..a5ea3f7 100644
> > --- a/net/netfilter/nft_numgen.c
> > +++ b/net/netfilter/nft_numgen.c
> > @@ -44,6 +44,7 @@ static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
> > [NFTA_NG_DREG] = { .type = NLA_U32 },
> > [NFTA_NG_MODULUS] = { .type = NLA_U32 },
> > [NFTA_NG_TYPE] = { .type = NLA_U32 },
> > + [NFTA_NG_SUM] = { .type = NLA_U32 },
> > };
> >
> > static int nft_ng_inc_init(const struct nft_ctx *ctx,
> > @@ -51,13 +52,17 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
> > const struct nlattr * const tb[])
> > {
> > struct nft_ng_inc *priv = nft_expr_priv(expr);
> > + u32 sum = 0;
> > +
> > + if (tb[NFTA_NG_SUM])
> > + sum = ntohl(nla_get_be32(tb[NFTA_NG_SUM]));
> >
> > priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS]));
> > - if (priv->modulus == 0)
> > + if (priv->modulus == 0 || sum >= priv->modulus)
> > return -ERANGE;
> >
> > priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
> > - atomic_set(&priv->counter, 0);
> > + atomic_set(&priv->counter, sum);
>
> Are you sure this will work?
>
> nval = (oval + 1 < priv->modulus) ? oval + 1 : 0;
>
> This is just setting priv->counter to an initial value, then it will
> become zero at some point.
>
I considered that the offset in the case of 'numgen inc' will be only
applied to initialize the counter to a certain value. Do you mean to
add the offset in every generated value?
Should the random counter behave in the same way?
> I'm going to take Liping's patch that converts:
>
> memcpy(®s->data[priv->dreg], &priv->counter, sizeof(u32));
>
> to:
>
> reg->data[priv->dreg] = nval;
>
> so you can change this to:
>
> reg->data[priv->dreg] = nval + priv->offset;
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] netfilter: nft_numgen: add increment counter offset value
2016-09-12 17:08 ` Laura Garcia
@ 2016-09-12 17:21 ` Pablo Neira Ayuso
0 siblings, 0 replies; 5+ messages in thread
From: Pablo Neira Ayuso @ 2016-09-12 17:21 UTC (permalink / raw)
To: Laura Garcia; +Cc: netfilter-devel
On Mon, Sep 12, 2016 at 07:08:24PM +0200, Laura Garcia wrote:
> On Mon, Sep 12, 2016 at 06:45:58PM +0200, Pablo Neira Ayuso wrote:
> > On Wed, Sep 07, 2016 at 07:56:49PM +0200, Laura Garcia Liebana wrote:
> > > Add support for an initialization counter value. With this option the
> > > sysadmin is able to start the counter when used with the increment type.
> > >
> > > Example:
> > >
> > > meta mark set numgen inc mod 2 sum 100
> > >
> > > This will generate marks with the serie 100, 101, 100, 101, ...
> > >
> > > Only supported for increment number generation.
> > >
> > > Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
> > > ---
> > > Changes in v2:
> > > - Separate _SUM_ changes with _until_ attribute renaming.
> > >
> > > include/uapi/linux/netfilter/nf_tables.h | 2 ++
> > > net/netfilter/nft_numgen.c | 9 +++++++--
> > > 2 files changed, 9 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> > > index 24161e2..00a689d 100644
> > > --- a/include/uapi/linux/netfilter/nf_tables.h
> > > +++ b/include/uapi/linux/netfilter/nf_tables.h
> > > @@ -1128,12 +1128,14 @@ enum nft_trace_types {
> > > * @NFTA_NG_DREG: destination register (NLA_U32)
> > > * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
> > > * @NFTA_NG_TYPE: operation type (NLA_U32)
> > > + * @NFTA_NG_SUM: Offset to initiate the counter (NLA_U32)
> > > */
> > > enum nft_ng_attributes {
> > > NFTA_NG_UNSPEC,
> > > NFTA_NG_DREG,
> > > NFTA_NG_MODULUS,
> > > NFTA_NG_TYPE,
> > > + NFTA_NG_SUM,
> > > __NFTA_NG_MAX
> > > };
> > > #define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
> > > diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
> > > index f51a3ed..a5ea3f7 100644
> > > --- a/net/netfilter/nft_numgen.c
> > > +++ b/net/netfilter/nft_numgen.c
> > > @@ -44,6 +44,7 @@ static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
> > > [NFTA_NG_DREG] = { .type = NLA_U32 },
> > > [NFTA_NG_MODULUS] = { .type = NLA_U32 },
> > > [NFTA_NG_TYPE] = { .type = NLA_U32 },
> > > + [NFTA_NG_SUM] = { .type = NLA_U32 },
> > > };
> > >
> > > static int nft_ng_inc_init(const struct nft_ctx *ctx,
> > > @@ -51,13 +52,17 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
> > > const struct nlattr * const tb[])
> > > {
> > > struct nft_ng_inc *priv = nft_expr_priv(expr);
> > > + u32 sum = 0;
> > > +
> > > + if (tb[NFTA_NG_SUM])
> > > + sum = ntohl(nla_get_be32(tb[NFTA_NG_SUM]));
> > >
> > > priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS]));
> > > - if (priv->modulus == 0)
> > > + if (priv->modulus == 0 || sum >= priv->modulus)
> > > return -ERANGE;
> > >
> > > priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
> > > - atomic_set(&priv->counter, 0);
> > > + atomic_set(&priv->counter, sum);
> >
> > Are you sure this will work?
> >
> > nval = (oval + 1 < priv->modulus) ? oval + 1 : 0;
> >
> > This is just setting priv->counter to an initial value, then it will
> > become zero at some point.
> >
>
> I considered that the offset in the case of 'numgen inc' will be only
> applied to initialize the counter to a certain value. Do you mean to
> add the offset in every generated value?
>
> Should the random counter behave in the same way?
I'm expecting this works just like nft_hash, ie.
numgen inc mod 2 offset 10
generates: 10, 11, 10, 11, ...
Then, for random:
numgen random mod 2 offset 10
generates (well, this should actually be random): 10, 10, 11, 10, 11, 10, 10,...
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] netfilter: nft_numgen: add increment counter offset value
2016-09-12 16:45 ` Pablo Neira Ayuso
2016-09-12 17:08 ` Laura Garcia
@ 2016-09-12 17:25 ` Laura Garcia
1 sibling, 0 replies; 5+ messages in thread
From: Laura Garcia @ 2016-09-12 17:25 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
On Mon, Sep 12, 2016 at 06:45:58PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Sep 07, 2016 at 07:56:49PM +0200, Laura Garcia Liebana wrote:
> > Add support for an initialization counter value. With this option the
> > sysadmin is able to start the counter when used with the increment type.
> >
> > Example:
> >
> > meta mark set numgen inc mod 2 sum 100
> >
> > This will generate marks with the serie 100, 101, 100, 101, ...
> >
> > Only supported for increment number generation.
> >
> > Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
> > ---
> > Changes in v2:
> > - Separate _SUM_ changes with _until_ attribute renaming.
> >
> > include/uapi/linux/netfilter/nf_tables.h | 2 ++
> > net/netfilter/nft_numgen.c | 9 +++++++--
> > 2 files changed, 9 insertions(+), 2 deletions(-)
> >
> > diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> > index 24161e2..00a689d 100644
> > --- a/include/uapi/linux/netfilter/nf_tables.h
> > +++ b/include/uapi/linux/netfilter/nf_tables.h
> > @@ -1128,12 +1128,14 @@ enum nft_trace_types {
> > * @NFTA_NG_DREG: destination register (NLA_U32)
> > * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
> > * @NFTA_NG_TYPE: operation type (NLA_U32)
> > + * @NFTA_NG_SUM: Offset to initiate the counter (NLA_U32)
> > */
> > enum nft_ng_attributes {
> > NFTA_NG_UNSPEC,
> > NFTA_NG_DREG,
> > NFTA_NG_MODULUS,
> > NFTA_NG_TYPE,
> > + NFTA_NG_SUM,
> > __NFTA_NG_MAX
> > };
> > #define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
> > diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
> > index f51a3ed..a5ea3f7 100644
> > --- a/net/netfilter/nft_numgen.c
> > +++ b/net/netfilter/nft_numgen.c
> > @@ -44,6 +44,7 @@ static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
> > [NFTA_NG_DREG] = { .type = NLA_U32 },
> > [NFTA_NG_MODULUS] = { .type = NLA_U32 },
> > [NFTA_NG_TYPE] = { .type = NLA_U32 },
> > + [NFTA_NG_SUM] = { .type = NLA_U32 },
> > };
> >
> > static int nft_ng_inc_init(const struct nft_ctx *ctx,
> > @@ -51,13 +52,17 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
> > const struct nlattr * const tb[])
> > {
> > struct nft_ng_inc *priv = nft_expr_priv(expr);
> > + u32 sum = 0;
> > +
> > + if (tb[NFTA_NG_SUM])
> > + sum = ntohl(nla_get_be32(tb[NFTA_NG_SUM]));
> >
> > priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS]));
> > - if (priv->modulus == 0)
> > + if (priv->modulus == 0 || sum >= priv->modulus)
> > return -ERANGE;
> >
> > priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
> > - atomic_set(&priv->counter, 0);
> > + atomic_set(&priv->counter, sum);
>
> Are you sure this will work?
>
> nval = (oval + 1 < priv->modulus) ? oval + 1 : 0;
>
> This is just setting priv->counter to an initial value, then it will
> become zero at some point.
>
Ok, I got it what you mean.
Thanks.
> I'm going to take Liping's patch that converts:
>
> memcpy(®s->data[priv->dreg], &priv->counter, sizeof(u32));
>
> to:
>
> reg->data[priv->dreg] = nval;
>
> so you can change this to:
>
> reg->data[priv->dreg] = nval + priv->offset;
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2016-09-12 17:25 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-07 17:56 [PATCH v2] netfilter: nft_numgen: add increment counter offset value Laura Garcia Liebana
2016-09-12 16:45 ` Pablo Neira Ayuso
2016-09-12 17:08 ` Laura Garcia
2016-09-12 17:21 ` Pablo Neira Ayuso
2016-09-12 17:25 ` Laura Garcia
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.