[PATCH iptables-nft] extensions: add xt_statistics random mode translation

[PATCH iptables-nft] extensions: add xt_statistics random mode translation

[Florian Westphal]

Use meta random and bitops to replicate what xt_statistics
is doing.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 extensions/libxt_statistic.c      | 8 +++++++-
 extensions/libxt_statistic.txlate | 2 +-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/extensions/libxt_statistic.c b/extensions/libxt_statistic.c
index 4f3341a3d116..37915adc8bc3 100644
--- a/extensions/libxt_statistic.c
+++ b/extensions/libxt_statistic.c
@@ -141,13 +141,19 @@ static int statistic_xlate(struct xt_xlate *xl,
 
 	switch (info->mode) {
 	case XT_STATISTIC_MODE_RANDOM:
-		return 0;
+		xt_xlate_add(xl, "meta random & %u %s %u",
+			     INT_MAX,
+			     info->flags & XT_STATISTIC_INVERT ? ">=" : "<",
+			     info->u.random.probability);
+		break;
 	case XT_STATISTIC_MODE_NTH:
 		xt_xlate_add(xl, "numgen inc mod %u %s%u",
 			     info->u.nth.every + 1,
 			     info->flags & XT_STATISTIC_INVERT ? "!= " : "",
 			     info->u.nth.packet);
 		break;
+	default:
+		return 0;
 	}
 
 	return 1;
diff --git a/extensions/libxt_statistic.txlate b/extensions/libxt_statistic.txlate
index 3196ff20b90d..627120c598a6 100644
--- a/extensions/libxt_statistic.txlate
+++ b/extensions/libxt_statistic.txlate
@@ -5,4 +5,4 @@ iptables-translate -A OUTPUT -m statistic --mode nth ! --every 10 --packet 5
 nft 'add rule ip filter OUTPUT numgen inc mod 10 != 5 counter'
 
 iptables-translate -A OUTPUT -m statistic --mode random --probability 0.1
-nft # -A OUTPUT -m statistic --mode random --probability 0.1
+nft 'add rule ip filter OUTPUT meta random & 2147483647 < 214748365 counter'
-- 
2.37.4

Re: [PATCH iptables-nft] extensions: add xt_statistics random mode translation

[Phil Sutter]

On Thu, Dec 01, 2022 at 11:13:17AM +0100, Florian Westphal wrote:
> Use meta random and bitops to replicate what xt_statistics
> is doing.

I didn't know about 'meta random', even though it's a bit older than
numgen. What's the difference to 'numgen random'? I'm asking because I
once tried to fix the same issue using the latter[1], it was never
applied, though.

Maybe you could reuse gcd_div() from my patch to reduce nominal values?

Cheers, Phil

[1] https://patchwork.ozlabs.org/project/netfilter-devel/patch/20170313160153.21120-1-phil@nwl.cc/

Re: [PATCH iptables-nft] extensions: add xt_statistics random mode translation

[Florian Westphal]

Phil Sutter <phil@nwl.cc> wrote:
> On Thu, Dec 01, 2022 at 11:13:17AM +0100, Florian Westphal wrote:
> > Use meta random and bitops to replicate what xt_statistics
> > is doing.
> 
> I didn't know about 'meta random', even though it's a bit older than
> numgen. What's the difference to 'numgen random'?

META_RANDOM is simpler. its really just setting a 32bit register to a
32bit random value.

No modulus, offset or anything like that is supported.

For most users, numgen random is much better because you can generate a
random number within a given range.

But this translation really does match exactly what xt_statistics is
doing.

> I'm asking because I
> once tried to fix the same issue using the latter[1], it was never
> applied, though.
> 
> Maybe you could reuse gcd_div() from my patch to reduce nominal values?

Why?  If you prefer numgen, maybe just rebase your patch and push it out?

Re: [PATCH iptables-nft] extensions: add xt_statistics random mode translation

[Phil Sutter]

On Thu, Dec 01, 2022 at 01:06:10PM +0100, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > On Thu, Dec 01, 2022 at 11:13:17AM +0100, Florian Westphal wrote:
> > > Use meta random and bitops to replicate what xt_statistics
> > > is doing.
> > 
> > I didn't know about 'meta random', even though it's a bit older than
> > numgen. What's the difference to 'numgen random'?
> 
> META_RANDOM is simpler. its really just setting a 32bit register to a
> 32bit random value.
> 
> No modulus, offset or anything like that is supported.
> 
> For most users, numgen random is much better because you can generate a
> random number within a given range.
> 
> But this translation really does match exactly what xt_statistics is
> doing.

OK, cool!

> > I'm asking because I
> > once tried to fix the same issue using the latter[1], it was never
> > applied, though.
> > 
> > Maybe you could reuse gcd_div() from my patch to reduce nominal values?
> 
> Why?  If you prefer numgen, maybe just rebase your patch and push it out?

No, I don't care whether meta or numgen. I just recall some
probability/mask values would trim down nicely and make things more
readable. Just push your patch please, I'll play with gcd() if time
allows.

Thanks, Phil