[v2] netfilter: nft_numgen: add increment counter offset value
diff mbox

Message ID 20160907175646.GA7317@sonyv
State Accepted
Delegated to: Pablo Neira
Headers show

Commit Message

Laura Garcia Sept. 7, 2016, 5:56 p.m. UTC
Add support for an initialization counter value. With this option the
sysadmin is able to start the counter when used with the increment type.

Example:

	meta mark set numgen inc mod 2 sum 100

This will generate marks with the serie 100, 101, 100, 101, ...

Only supported for increment number generation.

Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
---
Changes in v2:
	- Separate _SUM_ changes with _until_ attribute renaming.

 include/uapi/linux/netfilter/nf_tables.h | 2 ++
 net/netfilter/nft_numgen.c               | 9 +++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

Comments

Pablo Neira Ayuso Sept. 12, 2016, 4:45 p.m. UTC | #1
On Wed, Sep 07, 2016 at 07:56:49PM +0200, Laura Garcia Liebana wrote:
> Add support for an initialization counter value. With this option the
> sysadmin is able to start the counter when used with the increment type.
> 
> Example:
> 
> 	meta mark set numgen inc mod 2 sum 100
> 
> This will generate marks with the serie 100, 101, 100, 101, ...
> 
> Only supported for increment number generation.
> 
> Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
> ---
> Changes in v2:
> 	- Separate _SUM_ changes with _until_ attribute renaming.
> 
>  include/uapi/linux/netfilter/nf_tables.h | 2 ++
>  net/netfilter/nft_numgen.c               | 9 +++++++--
>  2 files changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> index 24161e2..00a689d 100644
> --- a/include/uapi/linux/netfilter/nf_tables.h
> +++ b/include/uapi/linux/netfilter/nf_tables.h
> @@ -1128,12 +1128,14 @@ enum nft_trace_types {
>   * @NFTA_NG_DREG: destination register (NLA_U32)
>   * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
>   * @NFTA_NG_TYPE: operation type (NLA_U32)
> + * @NFTA_NG_SUM: Offset to initiate the counter (NLA_U32)
>   */
>  enum nft_ng_attributes {
>  	NFTA_NG_UNSPEC,
>  	NFTA_NG_DREG,
>  	NFTA_NG_MODULUS,
>  	NFTA_NG_TYPE,
> +	NFTA_NG_SUM,
>  	__NFTA_NG_MAX
>  };
>  #define NFTA_NG_MAX	(__NFTA_NG_MAX - 1)
> diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
> index f51a3ed..a5ea3f7 100644
> --- a/net/netfilter/nft_numgen.c
> +++ b/net/netfilter/nft_numgen.c
> @@ -44,6 +44,7 @@ static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
>  	[NFTA_NG_DREG]		= { .type = NLA_U32 },
>  	[NFTA_NG_MODULUS]	= { .type = NLA_U32 },
>  	[NFTA_NG_TYPE]		= { .type = NLA_U32 },
> +	[NFTA_NG_SUM]		= { .type = NLA_U32 },
>  };
>  
>  static int nft_ng_inc_init(const struct nft_ctx *ctx,
> @@ -51,13 +52,17 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
>  			   const struct nlattr * const tb[])
>  {
>  	struct nft_ng_inc *priv = nft_expr_priv(expr);
> +	u32 sum = 0;
> +
> +	if (tb[NFTA_NG_SUM])
> +		sum = ntohl(nla_get_be32(tb[NFTA_NG_SUM]));
>  
>  	priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS]));
> -	if (priv->modulus == 0)
> +	if (priv->modulus == 0 || sum >= priv->modulus)
>  		return -ERANGE;
>  
>  	priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
> -	atomic_set(&priv->counter, 0);
> +	atomic_set(&priv->counter, sum);

Are you sure this will work?

        nval = (oval + 1 < priv->modulus) ? oval + 1 : 0;

This is just setting priv->counter to an initial value, then it will
become zero at some point.

I'm going to take Liping's patch that converts:

        memcpy(&regs->data[priv->dreg], &priv->counter, sizeof(u32));

to:

        reg->data[priv->dreg] = nval;

so you can change this to:

        reg->data[priv->dreg] = nval + priv->offset;
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Laura Garcia Sept. 12, 2016, 5:08 p.m. UTC | #2
On Mon, Sep 12, 2016 at 06:45:58PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Sep 07, 2016 at 07:56:49PM +0200, Laura Garcia Liebana wrote:
> > Add support for an initialization counter value. With this option the
> > sysadmin is able to start the counter when used with the increment type.
> > 
> > Example:
> > 
> > 	meta mark set numgen inc mod 2 sum 100
> > 
> > This will generate marks with the serie 100, 101, 100, 101, ...
> > 
> > Only supported for increment number generation.
> > 
> > Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
> > ---
> > Changes in v2:
> > 	- Separate _SUM_ changes with _until_ attribute renaming.
> > 
> >  include/uapi/linux/netfilter/nf_tables.h | 2 ++
> >  net/netfilter/nft_numgen.c               | 9 +++++++--
> >  2 files changed, 9 insertions(+), 2 deletions(-)
> > 
> > diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> > index 24161e2..00a689d 100644
> > --- a/include/uapi/linux/netfilter/nf_tables.h
> > +++ b/include/uapi/linux/netfilter/nf_tables.h
> > @@ -1128,12 +1128,14 @@ enum nft_trace_types {
> >   * @NFTA_NG_DREG: destination register (NLA_U32)
> >   * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
> >   * @NFTA_NG_TYPE: operation type (NLA_U32)
> > + * @NFTA_NG_SUM: Offset to initiate the counter (NLA_U32)
> >   */
> >  enum nft_ng_attributes {
> >  	NFTA_NG_UNSPEC,
> >  	NFTA_NG_DREG,
> >  	NFTA_NG_MODULUS,
> >  	NFTA_NG_TYPE,
> > +	NFTA_NG_SUM,
> >  	__NFTA_NG_MAX
> >  };
> >  #define NFTA_NG_MAX	(__NFTA_NG_MAX - 1)
> > diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
> > index f51a3ed..a5ea3f7 100644
> > --- a/net/netfilter/nft_numgen.c
> > +++ b/net/netfilter/nft_numgen.c
> > @@ -44,6 +44,7 @@ static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
> >  	[NFTA_NG_DREG]		= { .type = NLA_U32 },
> >  	[NFTA_NG_MODULUS]	= { .type = NLA_U32 },
> >  	[NFTA_NG_TYPE]		= { .type = NLA_U32 },
> > +	[NFTA_NG_SUM]		= { .type = NLA_U32 },
> >  };
> >  
> >  static int nft_ng_inc_init(const struct nft_ctx *ctx,
> > @@ -51,13 +52,17 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
> >  			   const struct nlattr * const tb[])
> >  {
> >  	struct nft_ng_inc *priv = nft_expr_priv(expr);
> > +	u32 sum = 0;
> > +
> > +	if (tb[NFTA_NG_SUM])
> > +		sum = ntohl(nla_get_be32(tb[NFTA_NG_SUM]));
> >  
> >  	priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS]));
> > -	if (priv->modulus == 0)
> > +	if (priv->modulus == 0 || sum >= priv->modulus)
> >  		return -ERANGE;
> >  
> >  	priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
> > -	atomic_set(&priv->counter, 0);
> > +	atomic_set(&priv->counter, sum);
> 
> Are you sure this will work?
> 
>         nval = (oval + 1 < priv->modulus) ? oval + 1 : 0;
> 
> This is just setting priv->counter to an initial value, then it will
> become zero at some point.
> 

I considered that the offset in the case of 'numgen inc' will be only
applied to initialize the counter to a certain value. Do you mean to
add the offset in every generated value?

Should the random counter behave in the same way?

> I'm going to take Liping's patch that converts:
> 
>         memcpy(&regs->data[priv->dreg], &priv->counter, sizeof(u32));
> 
> to:
> 
>         reg->data[priv->dreg] = nval;
> 
> so you can change this to:
> 
>         reg->data[priv->dreg] = nval + priv->offset;
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Pablo Neira Ayuso Sept. 12, 2016, 5:21 p.m. UTC | #3
On Mon, Sep 12, 2016 at 07:08:24PM +0200, Laura Garcia wrote:
> On Mon, Sep 12, 2016 at 06:45:58PM +0200, Pablo Neira Ayuso wrote:
> > On Wed, Sep 07, 2016 at 07:56:49PM +0200, Laura Garcia Liebana wrote:
> > > Add support for an initialization counter value. With this option the
> > > sysadmin is able to start the counter when used with the increment type.
> > > 
> > > Example:
> > > 
> > > 	meta mark set numgen inc mod 2 sum 100
> > > 
> > > This will generate marks with the serie 100, 101, 100, 101, ...
> > > 
> > > Only supported for increment number generation.
> > > 
> > > Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
> > > ---
> > > Changes in v2:
> > > 	- Separate _SUM_ changes with _until_ attribute renaming.
> > > 
> > >  include/uapi/linux/netfilter/nf_tables.h | 2 ++
> > >  net/netfilter/nft_numgen.c               | 9 +++++++--
> > >  2 files changed, 9 insertions(+), 2 deletions(-)
> > > 
> > > diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> > > index 24161e2..00a689d 100644
> > > --- a/include/uapi/linux/netfilter/nf_tables.h
> > > +++ b/include/uapi/linux/netfilter/nf_tables.h
> > > @@ -1128,12 +1128,14 @@ enum nft_trace_types {
> > >   * @NFTA_NG_DREG: destination register (NLA_U32)
> > >   * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
> > >   * @NFTA_NG_TYPE: operation type (NLA_U32)
> > > + * @NFTA_NG_SUM: Offset to initiate the counter (NLA_U32)
> > >   */
> > >  enum nft_ng_attributes {
> > >  	NFTA_NG_UNSPEC,
> > >  	NFTA_NG_DREG,
> > >  	NFTA_NG_MODULUS,
> > >  	NFTA_NG_TYPE,
> > > +	NFTA_NG_SUM,
> > >  	__NFTA_NG_MAX
> > >  };
> > >  #define NFTA_NG_MAX	(__NFTA_NG_MAX - 1)
> > > diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
> > > index f51a3ed..a5ea3f7 100644
> > > --- a/net/netfilter/nft_numgen.c
> > > +++ b/net/netfilter/nft_numgen.c
> > > @@ -44,6 +44,7 @@ static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
> > >  	[NFTA_NG_DREG]		= { .type = NLA_U32 },
> > >  	[NFTA_NG_MODULUS]	= { .type = NLA_U32 },
> > >  	[NFTA_NG_TYPE]		= { .type = NLA_U32 },
> > > +	[NFTA_NG_SUM]		= { .type = NLA_U32 },
> > >  };
> > >  
> > >  static int nft_ng_inc_init(const struct nft_ctx *ctx,
> > > @@ -51,13 +52,17 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
> > >  			   const struct nlattr * const tb[])
> > >  {
> > >  	struct nft_ng_inc *priv = nft_expr_priv(expr);
> > > +	u32 sum = 0;
> > > +
> > > +	if (tb[NFTA_NG_SUM])
> > > +		sum = ntohl(nla_get_be32(tb[NFTA_NG_SUM]));
> > >  
> > >  	priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS]));
> > > -	if (priv->modulus == 0)
> > > +	if (priv->modulus == 0 || sum >= priv->modulus)
> > >  		return -ERANGE;
> > >  
> > >  	priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
> > > -	atomic_set(&priv->counter, 0);
> > > +	atomic_set(&priv->counter, sum);
> > 
> > Are you sure this will work?
> > 
> >         nval = (oval + 1 < priv->modulus) ? oval + 1 : 0;
> > 
> > This is just setting priv->counter to an initial value, then it will
> > become zero at some point.
> > 
> 
> I considered that the offset in the case of 'numgen inc' will be only
> applied to initialize the counter to a certain value. Do you mean to
> add the offset in every generated value?
> 
> Should the random counter behave in the same way?

I'm expecting this works just like nft_hash, ie.

        numgen inc mod 2 offset 10

generates: 10, 11, 10, 11, ...

Then, for random:

        numgen random mod 2 offset 10

generates (well, this should actually be random): 10, 10, 11, 10, 11, 10, 10,...
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Laura Garcia Sept. 12, 2016, 5:25 p.m. UTC | #4
On Mon, Sep 12, 2016 at 06:45:58PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Sep 07, 2016 at 07:56:49PM +0200, Laura Garcia Liebana wrote:
> > Add support for an initialization counter value. With this option the
> > sysadmin is able to start the counter when used with the increment type.
> > 
> > Example:
> > 
> > 	meta mark set numgen inc mod 2 sum 100
> > 
> > This will generate marks with the serie 100, 101, 100, 101, ...
> > 
> > Only supported for increment number generation.
> > 
> > Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
> > ---
> > Changes in v2:
> > 	- Separate _SUM_ changes with _until_ attribute renaming.
> > 
> >  include/uapi/linux/netfilter/nf_tables.h | 2 ++
> >  net/netfilter/nft_numgen.c               | 9 +++++++--
> >  2 files changed, 9 insertions(+), 2 deletions(-)
> > 
> > diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
> > index 24161e2..00a689d 100644
> > --- a/include/uapi/linux/netfilter/nf_tables.h
> > +++ b/include/uapi/linux/netfilter/nf_tables.h
> > @@ -1128,12 +1128,14 @@ enum nft_trace_types {
> >   * @NFTA_NG_DREG: destination register (NLA_U32)
> >   * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
> >   * @NFTA_NG_TYPE: operation type (NLA_U32)
> > + * @NFTA_NG_SUM: Offset to initiate the counter (NLA_U32)
> >   */
> >  enum nft_ng_attributes {
> >  	NFTA_NG_UNSPEC,
> >  	NFTA_NG_DREG,
> >  	NFTA_NG_MODULUS,
> >  	NFTA_NG_TYPE,
> > +	NFTA_NG_SUM,
> >  	__NFTA_NG_MAX
> >  };
> >  #define NFTA_NG_MAX	(__NFTA_NG_MAX - 1)
> > diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
> > index f51a3ed..a5ea3f7 100644
> > --- a/net/netfilter/nft_numgen.c
> > +++ b/net/netfilter/nft_numgen.c
> > @@ -44,6 +44,7 @@ static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
> >  	[NFTA_NG_DREG]		= { .type = NLA_U32 },
> >  	[NFTA_NG_MODULUS]	= { .type = NLA_U32 },
> >  	[NFTA_NG_TYPE]		= { .type = NLA_U32 },
> > +	[NFTA_NG_SUM]		= { .type = NLA_U32 },
> >  };
> >  
> >  static int nft_ng_inc_init(const struct nft_ctx *ctx,
> > @@ -51,13 +52,17 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx,
> >  			   const struct nlattr * const tb[])
> >  {
> >  	struct nft_ng_inc *priv = nft_expr_priv(expr);
> > +	u32 sum = 0;
> > +
> > +	if (tb[NFTA_NG_SUM])
> > +		sum = ntohl(nla_get_be32(tb[NFTA_NG_SUM]));
> >  
> >  	priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS]));
> > -	if (priv->modulus == 0)
> > +	if (priv->modulus == 0 || sum >= priv->modulus)
> >  		return -ERANGE;
> >  
> >  	priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
> > -	atomic_set(&priv->counter, 0);
> > +	atomic_set(&priv->counter, sum);
> 
> Are you sure this will work?
> 
>         nval = (oval + 1 < priv->modulus) ? oval + 1 : 0;
> 
> This is just setting priv->counter to an initial value, then it will
> become zero at some point.
> 

Ok, I got it what you mean.

Thanks.

> I'm going to take Liping's patch that converts:
> 
>         memcpy(&regs->data[priv->dreg], &priv->counter, sizeof(u32));
> 
> to:
> 
>         reg->data[priv->dreg] = nval;
> 
> so you can change this to:
> 
>         reg->data[priv->dreg] = nval + priv->offset;
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch
diff mbox

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 24161e2..00a689d 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1128,12 +1128,14 @@  enum nft_trace_types {
  * @NFTA_NG_DREG: destination register (NLA_U32)
  * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
  * @NFTA_NG_TYPE: operation type (NLA_U32)
+ * @NFTA_NG_SUM: Offset to initiate the counter (NLA_U32)
  */
 enum nft_ng_attributes {
 	NFTA_NG_UNSPEC,
 	NFTA_NG_DREG,
 	NFTA_NG_MODULUS,
 	NFTA_NG_TYPE,
+	NFTA_NG_SUM,
 	__NFTA_NG_MAX
 };
 #define NFTA_NG_MAX	(__NFTA_NG_MAX - 1)
diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c
index f51a3ed..a5ea3f7 100644
--- a/net/netfilter/nft_numgen.c
+++ b/net/netfilter/nft_numgen.c
@@ -44,6 +44,7 @@  static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = {
 	[NFTA_NG_DREG]		= { .type = NLA_U32 },
 	[NFTA_NG_MODULUS]	= { .type = NLA_U32 },
 	[NFTA_NG_TYPE]		= { .type = NLA_U32 },
+	[NFTA_NG_SUM]		= { .type = NLA_U32 },
 };
 
 static int nft_ng_inc_init(const struct nft_ctx *ctx,
@@ -51,13 +52,17 @@  static int nft_ng_inc_init(const struct nft_ctx *ctx,
 			   const struct nlattr * const tb[])
 {
 	struct nft_ng_inc *priv = nft_expr_priv(expr);
+	u32 sum = 0;
+
+	if (tb[NFTA_NG_SUM])
+		sum = ntohl(nla_get_be32(tb[NFTA_NG_SUM]));
 
 	priv->modulus = ntohl(nla_get_be32(tb[NFTA_NG_MODULUS]));
-	if (priv->modulus == 0)
+	if (priv->modulus == 0 || sum >= priv->modulus)
 		return -ERANGE;
 
 	priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]);
-	atomic_set(&priv->counter, 0);
+	atomic_set(&priv->counter, sum);
 
 	return nft_validate_register_store(ctx, priv->dreg, NULL,
 					   NFT_DATA_VALUE, sizeof(u32));