On Wed, Mar 02, 2016 at 01:10:33PM +0100, Florian Westphal wrote: > Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > I think meta random 0.10000000009 will only match for the exact case. > > No; I thought that 'nft ... meta random 0.5' should on average match half of > the time so the proposed nft prandom patch set makes LE the default op. > > So meta random 0.1 is in fact 'meta random le 0.1' (and nft will display > it like this). > > > > $ iptables-translate -A INPUT -m statistic --mode random ! --probability > > > 0.1 -j ACCEPT > > > nft add rule ip filter INPUT meta random != 0.10000000009 counter accept > > > > Then, the opposite has to be: > > > > meta random gte 0.10000000009 > > Good point, this is not intuitive. > > Currently if no operator is given and the type is TYPE_PROBABILITY then > we just use le instead of eq (just like we pick "&" in some cases). > > But if user asks 'meta random ne 0.1' then the match propability is close > to 100%. > > Do you think its enough to just document that you need to use le/ge etc. > for this? > > Other option would be to rewrite NE to GE if rh value is a probability, > but I'm not sure if such 'helpful' logic isn't too likely to get in the > way. > > Yet another option is to just disallow EQ and NE ops and throw an error. > > Other suggestions? I'm fine with the probability scaling, but I think we should keep this consistent with other selectors, so I would use lt and gte instead here. We can potentially use ranges here too and other available operations such as prefixes (although this one I don't know use case for this). Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
