Skip to content

Commit 9ea81ca

Browse files
hedrokhedrok
committed
T75: ipt-netflow enable sampler, mac and vlan
Enable sampler, MAC address and VLAN recording. For this to work two patches are needed: * 0001-Fix-prandom_u32-_max-get_random_u32-_below: fix interface updates for random numbers, took fix from aabc/ipt-netflow@0c5759d * 0002-Fix-lu-llu-where-64bit: Fix lu -> llu for 64-bit fields
1 parent 16a76cd commit 9ea81ca

3 files changed

Lines changed: 223 additions & 1 deletion

File tree

‎scripts/package-build/linux-kernel/build-ipt-netflow.sh‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,14 @@ if [ -d .git ]; then
1919
git clean --force -d -x
2020
fi
2121

22+
# Possibly making fork makes more sense in this case?..
23+
PATCH_DIR=${CWD}/patches/ipt-netflow
24+
for patch in $(ls ${PATCH_DIR})
25+
do
26+
echo "I: Apply ipt-netflow patch: ${PATCH_DIR}/${patch}"
27+
patch -p1 < ${PATCH_DIR}/${patch}
28+
done
29+
2230
. ${KERNEL_VAR_FILE}
2331

2432
DRIVER_VERSION=$(git describe | sed s/^v//)
@@ -29,7 +37,7 @@ DEBIAN_DIR="tmp/"
2937
DEBIAN_CONTROL="${DEBIAN_DIR}/DEBIAN/control"
3038
DEBIAN_POSTINST="${CWD}/vyos-ipt-netflow.postinst"
3139

32-
./configure --enable-aggregation --kdir=${KERNEL_DIR}
40+
./configure --enable-macaddress --enable-vlan --enable-sampler --enable-aggregation --kdir=${KERNEL_DIR}
3341
make all
3442

3543
if [ "x$?" != "x0" ]; then

‎scripts/package-build/linux-kernel/patches/ipt-netflow/0001-Fix-prandom_u32-_max-get_random_u32-_below.patch‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
From 4afd69cf67de6f48bf54bce4a248c60b36078fe8 Mon Sep 17 00:00:00 2001
2+
From: Jaco Kroon <jaco@uls.co.za>
3+
Date: Mon, 17 Mar 2025 16:43:30 +0200
4+
Subject: [PATCH 1/2] Fix prandom_u32{,_max} => get_random_u32{,_below}
5+
6+
For backwards compatiblity this gets pretty nasty. This should work
7+
fairly well.
8+
9+
Signed-off-by: Jaco Kroon <jaco@uls.co.za>
10+
---
11+
compat.h | 33 +++++++++++++++++++++++++--------
12+
gen_compat_def | 44 ++++++++++++++++++++++++++++++++++++++------
13+
ipt_NETFLOW.c | 6 +++---
14+
3 files changed, 66 insertions(+), 17 deletions(-)
15+
16+
diff --git a/compat.h b/compat.h
17+
index 8461c3d..b44f861 100644
18+
--- a/compat.h
19+
+++ b/compat.h
20+
@@ -108,17 +108,34 @@ union nf_inet_addr {
21+
# define time_is_after_jiffies(a) time_before(jiffies, a)
22+
#endif
23+
24+
-#if LINUX_VERSION_CODE < KERNEL_VERSION(3,14,0)
25+
-# if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
26+
-# define prandom_u32 get_random_int
27+
-# elif LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0)
28+
-# define prandom_u32 random32
29+
+#ifndef HAVE_GET_RANDOM_U32
30+
+# ifdef HAVE_PRANDOM_U32
31+
+# ifdef HAVE_PRANDOM_H
32+
+# include <linux/prandom.h>
33+
+# endif
34+
+static inline u32 get_random_u32() {
35+
+ return prandom_u32();
36+
+}
37+
+# else
38+
+# pragma error Need fallback for get_random_u32
39+
+# endif
40+
#endif
41+
-#define prandom_u32_max compat_prandom_u32_max
42+
-static inline u32 prandom_u32_max(u32 ep_ro)
43+
+
44+
+#ifndef HAVE_GET_RANDOM_U32_BELOW
45+
+# ifdef HAVE_PRANDOM_U32_MAX
46+
+# ifdef HAVE_PRANDOM_H
47+
+# include <linux/prandom.h>
48+
+# endif
49+
+static inline u32 get_random_u32_below(u32 ep_ro)
50+
{
51+
- return (u32)(((u64) prandom_u32() * ep_ro) >> 32);
52+
+ return prandom_u32_max(ep_ro);
53+
}
54+
+# else
55+
+static inline u32 get_random_u32_below(u32 ep_ro)
56+
+{
57+
+ return (u32)(((u64) get_random_u32() * ep_ro) >> 32);
58+
+}
59+
+# endif
60+
#endif
61+
62+
#ifndef min_not_zero
63+
diff --git a/gen_compat_def b/gen_compat_def
64+
index a9cb95e..6440d5c 100755
65+
--- a/gen_compat_def
66+
+++ b/gen_compat_def
67+
@@ -1,4 +1,4 @@
68+
-#!/bin/bash -efu
69+
+#!/bin/bash -fu
70+
# SPDX-License-Identifier: GPL-2.0-only
71+
#
72+
# Generate defines based on kernel having some symbols declared.
73+
@@ -21,7 +21,7 @@ WD=cc-test-build
74+
mkdir -p $WD
75+
cd ./$WD || fatal "cannot cd to $WD"
76+
77+
-# args: HAVE_SUMBOL symbol include
78+
+# args: HAVE_SYMBOL symbol [include] [success] [failure]
79+
kbuild_test_compile() {
80+
local cmd
81+
82+
@@ -30,14 +30,15 @@ kbuild_test_compile() {
83+
cmd="make -s -B -C $KDIR M=$PWD modules"
84+
echo "$cmd" > log
85+
if $cmd >> log 2>&1; then
86+
- echo " declared" >&2
87+
- [ "$2" ] && echo "// $2 is declared ${3:+in <$3>}"
88+
+ echo " ${4-declared}" >&2
89+
+ [ "$2" ] && echo "// $2 ${4-is declared}${3:+ in <$3>}"
90+
echo "#define HAVE_$1"
91+
echo
92+
+ return 0
93+
else
94+
- echo " undeclared" >&2
95+
+ echo " ${5-undeclared}" >&2
96+
echo "#undef HAVE_$1"
97+
- echo "// ${2:-symbol} is undeclared${3:+ in <$3>}. Compile:"
98+
+ echo "// ${2:-symbol} ${5-is undeclared}${3:+ in <$3>}. Compile:"
99+
sed "s/^/\/\/ /" test.c
100+
echo "// Output:"
101+
sed "s/^/\/\/ /" log
102+
@@ -56,6 +57,7 @@ kbuild_test_compile() {
103+
echo >&2
104+
exit 3
105+
fi
106+
+ return 1
107+
fi
108+
}
109+
110+
@@ -105,6 +107,22 @@ kbuild_test_member() {
111+
typeof(((struct $structname*)0)->$member) test;
112+
EOF
113+
}
114+
+
115+
+# Test that a header is available/exist
116+
+kbuild_test_header() {
117+
+ echo -n "Test header $*" >&2
118+
+ structname=${1%.*}
119+
+ member=${1#*.}
120+
+ def=${1^^}
121+
+ def=${def##*/}
122+
+ def=${def//./_}
123+
+ kbuild_test_compile $def "header $1" "" "exists" "doesn't exist" <<-EOF
124+
+ #include <linux/module.h>
125+
+ #include <$1>
126+
+ MODULE_LICENSE("GPL");
127+
+ EOF
128+
+}
129+
+
130+
echo "// Autogenerated for $KDIR"
131+
echo
132+
133+
@@ -129,6 +147,20 @@ kbuild_test_ref totalram_pages linux/mm.h
134+
kbuild_test_member nf_ct_event_notifier.ct_event net/netfilter/nf_conntrack_ecache.h
135+
# 6.4: 0199849acd07 ("sysctl: remove register_sysctl_paths()")
136+
kbuild_test_symbol register_sysctl_paths linux/sysctl.h
137+
+# Do we have get_random_u32_below
138+
+kbuild_test_symbol get_random_u32_below linux/random.h
139+
+# Do we have get_random_u32
140+
+kbuild_test_symbol get_random_u32 linux/random.h
141+
+
142+
+# prandom functions moved from random.h to prandom.h recentish.
143+
+# We use these for fallback for the above only.
144+
+if kbuild_test_header linux/prandom.h; then
145+
+ prand_h=linux/prandom.h
146+
+else
147+
+ prand_h=linux/random.h
148+
+fi
149+
+kbuild_test_symbol prandom_u32 $prand_h
150+
+kbuild_test_symbol prandom_u32_max $prand_h
151+
152+
echo "// End of compat_def.h"
153+
154+
diff --git a/ipt_NETFLOW.c b/ipt_NETFLOW.c
155+
index eee8074..fefe809 100644
156+
--- a/ipt_NETFLOW.c
157+
+++ b/ipt_NETFLOW.c
158+
@@ -4454,7 +4454,7 @@ static int netflow_scan_and_export(const int flush)
159+
val = nf->sampler_count % interval;
160+
break;
161+
case SAMPLER_RANDOM:
162+
- val = prandom_u32_max(interval);
163+
+ val = get_random_u32_below(interval);
164+
break;
165+
default: /* SAMPLER_HASH */
166+
val = 0;
167+
@@ -5709,12 +5709,12 @@ static int __init ipt_netflow_init(void)
168+
}
169+
parse_sampler(sampler);
170+
#ifdef SAMPLING_HASH
171+
- hash_seed = prandom_u32();
172+
+ hash_seed = get_random_u32();
173+
#endif
174+
#endif
175+
176+
#ifdef ENABLE_RANDOM_TEMPLATE_IDS
177+
- template_ids = FLOWSET_DATA_FIRST | prandom_u32_max(0x00010000);
178+
+ template_ids = FLOWSET_DATA_FIRST | get_random_u32_below(0x00010000);
179+
#endif
180+
181+
#ifdef SNMP_RULES
182+
--
183+
2.50.1
184+

‎scripts/package-build/linux-kernel/patches/ipt-netflow/0002-Fix-lu-llu-where-64bit.patch‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
From b2e39db56640ba7d437a5edbd67889425969623e Mon Sep 17 00:00:00 2001
2+
From: Kyrylo Yatsenko <hedrok@gmail.com>
3+
Date: Sat, 30 Aug 2025 22:20:02 +0300
4+
Subject: [PATCH 2/2] Fix lu -> llu where 64bit
5+
6+
---
7+
ipt_NETFLOW.c | 4 ++--
8+
1 file changed, 2 insertions(+), 2 deletions(-)
9+
10+
diff --git a/ipt_NETFLOW.c b/ipt_NETFLOW.c
11+
index fefe809..08e9442 100644
12+
--- a/ipt_NETFLOW.c
13+
+++ b/ipt_NETFLOW.c
14+
@@ -759,11 +759,11 @@ static int nf_seq_show(struct seq_file *seq, void *v)
15+
sampler_mode_string(),
16+
get_sampler_interval());
17+
if (get_sampler_mode() != SAMPLER_HASH)
18+
- seq_printf(seq, " Flows selected %lu, discarded %lu.",
19+
+ seq_printf(seq, " Flows selected %llu, discarded %llu.",
20+
atomic64_read(&flows_selected),
21+
atomic64_read(&flows_observed) - atomic64_read(&flows_selected));
22+
else
23+
- seq_printf(seq, " Flows selected %lu.", atomic64_read(&flows_selected));
24+
+ seq_printf(seq, " Flows selected %llu.", atomic64_read(&flows_selected));
25+
seq_printf(seq, " Pkts selected %llu, discarded %llu.\n",
26+
t.pkts_selected,
27+
t.pkts_observed - t.pkts_selected);
28+
--
29+
2.50.1
30+

0 commit comments

Comments
 (0)