netfilter: nft_numgen: add counter offset value and rename until by modulus
Subsystems (2)
PATCH 1/1 netfilter: nft_numgen: add counter offset value and rename until by modulus
Add support for an initialization counter value. With this option the sysadmin is able to start the counter when used with the increment type.
Example:
meta mark set numgen inc mod 2 sum 100
This will generate marks with the serie 100, 101, 100, 101, ...
The _until_ attribute is renamed to _modulus_ as the behaviour is similar to other expresions with number limits(ex. nft_hash).
--- include/uapi/linux/netfilter/nf_tables.h | 6 ++++-- net/netfilter/nft_numgen.c | 37 ++++++++++++++++++-------------- 2 files changed, 25 insertions(+), 18 deletions(-)
include/uapi/linux/netfilter/nf_tables.h +4 -2
@@ -1151,14 +1151,16 @@ enum nft_trace_types {* attributes * * @NFTA_NG_DREG: destination register (NLA_U32) -* @NFTA_NG_UNTIL: source value to increment the counter until reset (NLA_U32) +* @NFTA_NG_MODULUS: maximum counter value (NLA_U32) * @NFTA_NG_TYPE: operation type (NLA_U32) +* @NFTA_NG_SUM: Offset to initiate the counter (NLA_U32) */ enum nft_ng_attributes {NFTA_NG_UNSPEC ,NFTA_NG_DREG , -NFTA_NG_UNTIL , +NFTA_NG_MODULUS ,NFTA_NG_TYPE , +NFTA_NG_SUM , __NFTA_NG_MAX };#define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
net/netfilter/nft_numgen.c +21 -16
@@ -21,7 +21,7 @@ static DEFINE_PER_CPU(struct rnd_state, nft_numgen_prandom_state);struct nft_ng_inc {enum nft_registers dreg:8 ; -u32 until; +u32 modulus;atomic_t counter; };
@@ -34,7 +34,7 @@ static void nft_ng_inc_eval(const struct nft_expr *expr,do { oval =atomic_read (&priv->counter); - nval = (oval +1 < priv->until) ? oval +1 :0 ; + nval = (oval +1 < priv->modulus) ? oval +1 :0 ; }while (atomic_cmpxchg (&priv->counter, oval, nval) != oval);memcpy (®s->data[priv->dreg], &priv->counter,sizeof (u32));
@@ -42,8 +42,9 @@ static void nft_ng_inc_eval(const struct nft_expr *expr,const struct nla_policy nft_ng_policy[NFTA_NG_MAX +1 ] = { [NFTA_NG_DREG ] = { .type =NLA_U32 }, - [NFTA_NG_UNTIL ] = { .type =NLA_U32 }, + [NFTA_NG_MODULUS ] = { .type =NLA_U32 }, [NFTA_NG_TYPE ] = { .type =NLA_U32 }, + [NFTA_NG_SUM ] = { .type =NLA_U32 }, }; static int nft_ng_inc_init(const struct nft_ctx *ctx,
@@ -51,27 +52,31 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx, const struct nlattr * const tb[]) {struct nft_ng_inc *priv =nft_expr_priv (expr); +u32 sum =0 ; - priv->until =ntohl (nla_get_be32 (tb[NFTA_NG_UNTIL ])); -if (priv->until ==0 ) +if (tb[NFTA_NG_SUM ]) + sum =ntohl (nla_get_be32 (tb[NFTA_NG_SUM ])); + + priv->modulus =ntohl (nla_get_be32 (tb[NFTA_NG_MODULUS ])); +if (priv->modulus ==0 || sum >= priv->modulus)return -ERANGE ; priv->dreg =nft_parse_register (tb[NFTA_NG_DREG ]);if (priv->dreg <0 )return -ERANGE ; -atomic_set (&priv->counter,0 ); +atomic_set (&priv->counter, sum);return nft_validate_register_store (ctx, priv->dreg,NULL ,NFT_DATA_VALUE ,sizeof (u32)); }static int nft_ng_dump (struct sk_buff *skb,enum nft_registers dreg, -u32 until,enum nft_ng_types type) +u32 modulus,enum nft_ng_types type) {if (nft_dump_register (skb,NFTA_NG_DREG , dreg)) goto nla_put_failure; -if (nft_dump_register (skb,NFTA_NG_UNTIL , until)) +if (nft_dump_register (skb,NFTA_NG_MODULUS , modulus)) goto nla_put_failure;if (nft_dump_register (skb,NFTA_NG_TYPE , type)) goto nla_put_failure;
@@ -86,12 +91,12 @@ static int nft_ng_inc_dump(struct sk_buff *skb, const struct nft_expr *expr) {const struct nft_ng_inc *priv =nft_expr_priv (expr); -return nft_ng_dump (skb, priv->dreg, priv->until,NFT_NG_INCREMENTAL ); +return nft_ng_dump (skb, priv->dreg, priv->modulus,NFT_NG_INCREMENTAL ); }struct nft_ng_random {enum nft_registers dreg:8 ; -u32 until; +u32 modulus; }; static void nft_ng_random_eval(const struct nft_expr *expr,
@@ -102,7 +107,7 @@ static void nft_ng_random_eval(const struct nft_expr *expr,struct rnd_state *state =this_cpu_ptr (&nft_numgen_prandom_state); regs->data[priv->dreg] =reciprocal_scale (prandom_u32_state (state), - priv->until); + priv->modulus); } static int nft_ng_random_init(const struct nft_ctx *ctx,
@@ -111,8 +116,8 @@ static int nft_ng_random_init(const struct nft_ctx *ctx, {struct nft_ng_random *priv =nft_expr_priv (expr); - priv->until =ntohl (nla_get_be32 (tb[NFTA_NG_UNTIL ])); -if (priv->until ==0 ) + priv->modulus =ntohl (nla_get_be32 (tb[NFTA_NG_MODULUS ])); +if (priv->modulus ==0 )return -ERANGE ;prandom_init_once (&nft_numgen_prandom_state);
@@ -129,7 +134,7 @@ static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr) {const struct nft_ng_random *priv =nft_expr_priv (expr); -return nft_ng_dump (skb, priv->dreg, priv->until,NFT_NG_RANDOM ); +return nft_ng_dump (skb, priv->dreg, priv->modulus,NFT_NG_RANDOM ); }static struct nft_expr_type nft_ng_type;
@@ -154,8 +159,8 @@ nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[]) {u32 type; -if (!tb[NFTA_NG_DREG ] || - !tb[NFTA_NG_UNTIL ] || +if (!tb[NFTA_NG_DREG ] || + !tb[NFTA_NG_MODULUS ] || !tb[NFTA_NG_TYPE ])return ERR_PTR (-EINVAL );
Signature · 1 line
2.8.1
Pablo Neira Ayuso
maintainerQuoted 24 lines · Laura Garcia Liebana
Add support for an initialization counter value. With this option the sysadmin is able to start the counter when used with the increment type.
Example:
meta mark set numgen inc mod 2 sum 100
This will generate marks with the serie 100, 101, 100, 101, ...
The _until_ attribute is renamed to _modulus_ as the behaviour is similar to other expresions with number limits(ex.
nft_hash).Signed-off-by Laura Garcia Liebana <[email protected]>--- include/uapi/linux/netfilter/nf_tables.h | 6 ++++-- net/netfilter/nft_numgen.c | 37 ++++++++++++++++++-------------- 2 files changed, 25 insertions(+), 18 deletions(-)include/uapi/linux/netfilter/nf_tables.h +0
-0
include/uapi/linux/netfilter/nf_tables.h enum nft_trace_types { · line 1156
Quoted 7 lines
include/uapi/linux/netfilter/nf_tables.h +2
-1@@ -1151,14 +1151,16 @@ enum nft_trace_types {* attributes * * @NFTA_NG_DREG: destination register (NLA_U32) -* @NFTA_NG_UNTIL: source value to increment the counter until reset (NLA_U32) +* @NFTA_NG_MODULUS: maximum counter value (NLA_U32) * @NFTA_NG_TYPE: operation type (NLA_U32) +* @NFTA_NG_SUM: Offset to initiate the counter (NLA_U32)
This needs two different patches.
In general, if you describe two things that don't relate each other in your patch, then this is asking for two patches.
On top of that, if you split patches in logical pieces, you usually make it easier for the reviewers to spot problems.
BTW, please include in your description that this rename is possible because we didn't release any kernel version with these changes yet, that's why this is still possible.