Commit b07edbe1 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netfilter: meta: add PRANDOM support

Can be used to randomly match packets e.g. for statistic traffic sampling.

See commit 3ad00405
("bpf: split state from prandom_u32() and consolidate {c, e}BPF prngs")
for more info why this doesn't use prandom_u32 directly.

Unlike bpf nft_meta can be built as a module, so add an EXPORT_SYMBOL
for prandom_seed_full_state too.

Cc: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent f12d33f4
...@@ -681,6 +681,7 @@ enum nft_exthdr_attributes { ...@@ -681,6 +681,7 @@ enum nft_exthdr_attributes {
* @NFT_META_IIFGROUP: packet input interface group * @NFT_META_IIFGROUP: packet input interface group
* @NFT_META_OIFGROUP: packet output interface group * @NFT_META_OIFGROUP: packet output interface group
* @NFT_META_CGROUP: socket control group (skb->sk->sk_classid) * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
* @NFT_META_PRANDOM: a 32bit pseudo-random number
*/ */
enum nft_meta_keys { enum nft_meta_keys {
NFT_META_LEN, NFT_META_LEN,
...@@ -707,6 +708,7 @@ enum nft_meta_keys { ...@@ -707,6 +708,7 @@ enum nft_meta_keys {
NFT_META_IIFGROUP, NFT_META_IIFGROUP,
NFT_META_OIFGROUP, NFT_META_OIFGROUP,
NFT_META_CGROUP, NFT_META_CGROUP,
NFT_META_PRANDOM,
}; };
/** /**
......
...@@ -255,6 +255,7 @@ void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state) ...@@ -255,6 +255,7 @@ void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state)
prandom_warmup(state); prandom_warmup(state);
} }
} }
EXPORT_SYMBOL(prandom_seed_full_state);
/* /*
* Generate better values after random number generator * Generate better values after random number generator
......
...@@ -28,6 +28,8 @@ ...@@ -28,6 +28,8 @@
#include <uapi/linux/netfilter_bridge.h> /* NF_BR_PRE_ROUTING */ #include <uapi/linux/netfilter_bridge.h> /* NF_BR_PRE_ROUTING */
static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state);
void nft_meta_get_eval(const struct nft_expr *expr, void nft_meta_get_eval(const struct nft_expr *expr,
struct nft_regs *regs, struct nft_regs *regs,
const struct nft_pktinfo *pkt) const struct nft_pktinfo *pkt)
...@@ -181,6 +183,11 @@ void nft_meta_get_eval(const struct nft_expr *expr, ...@@ -181,6 +183,11 @@ void nft_meta_get_eval(const struct nft_expr *expr,
*dest = sock_cgroup_classid(&sk->sk_cgrp_data); *dest = sock_cgroup_classid(&sk->sk_cgrp_data);
break; break;
#endif #endif
case NFT_META_PRANDOM: {
struct rnd_state *state = this_cpu_ptr(&nft_prandom_state);
*dest = prandom_u32_state(state);
break;
}
default: default:
WARN_ON(1); WARN_ON(1);
goto err; goto err;
...@@ -277,6 +284,10 @@ int nft_meta_get_init(const struct nft_ctx *ctx, ...@@ -277,6 +284,10 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
case NFT_META_OIFNAME: case NFT_META_OIFNAME:
len = IFNAMSIZ; len = IFNAMSIZ;
break; break;
case NFT_META_PRANDOM:
prandom_init_once(&nft_prandom_state);
len = sizeof(u32);
break;
default: default:
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment