Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b07edbe1 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: meta: add PRANDOM support 



Can be used to randomly match packets e.g. for statistic traffic sampling.

See commit 3ad00405
("bpf: split state from prandom_u32() and consolidate {c, e}BPF prngs")
for more info why this doesn't use prandom_u32 directly.

Unlike bpf nft_meta can be built as a module, so add an EXPORT_SYMBOL
for prandom_seed_full_state too.

Cc: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent f12d33f4

include/uapi/linux/netfilter/nf_tables.h

+2 −0
Original line number Diff line number Diff line
@@ -681,6 +681,7 @@ enum nft_exthdr_attributes { 
 * @NFT_META_IIFGROUP: packet input interface group

 * @NFT_META_OIFGROUP: packet output interface group

 * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)

 * @NFT_META_PRANDOM: a 32bit pseudo-random number

 */

enum nft_meta_keys {

	NFT_META_LEN,
@@ -707,6 +708,7 @@ enum nft_meta_keys { 
	NFT_META_IIFGROUP,

	NFT_META_OIFGROUP,

	NFT_META_CGROUP,

	NFT_META_PRANDOM,

};



/**

lib/random32.c

+1 −0
Original line number Diff line number Diff line
@@ -255,6 +255,7 @@ void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state) 
		prandom_warmup(state);

	}

}

EXPORT_SYMBOL(prandom_seed_full_state);



/*

 *	Generate better values after random number generator

net/netfilter/nft_meta.c

+11 −0
Original line number Diff line number Diff line
@@ -28,6 +28,8 @@ 


#include <uapi/linux/netfilter_bridge.h> /* NF_BR_PRE_ROUTING */



static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state);



void nft_meta_get_eval(const struct nft_expr *expr,

		       struct nft_regs *regs,

		       const struct nft_pktinfo *pkt)
@@ -181,6 +183,11 @@ void nft_meta_get_eval(const struct nft_expr *expr, 
		*dest = sock_cgroup_classid(&sk->sk_cgrp_data);

		break;

#endif

	case NFT_META_PRANDOM: {

		struct rnd_state *state = this_cpu_ptr(&nft_prandom_state);

		*dest = prandom_u32_state(state);

		break;

	}

	default:

		WARN_ON(1);

		goto err;
@@ -277,6 +284,10 @@ int nft_meta_get_init(const struct nft_ctx *ctx, 
	case NFT_META_OIFNAME:

		len = IFNAMSIZ;

		break;

	case NFT_META_PRANDOM:

		prandom_init_once(&nft_prandom_state);

		len = sizeof(u32);

		break;

	default:

		return -EOPNOTSUPP;

	}