The hash expression requires a seed attribute to call the jhash
operation, eg.
# nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 \
seed 0xdeadbeef
With this patch the seed attribute is optional and it's generated by a
random function from userspace, eg.
# nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2
To generate a secure random number it has been included the libbsd
library dependency by default, that implements the arc4random()
function generator. But it's possible to get rid of this dependency
applying the option --without-arc4random during the configure of the
package.
Suggested-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Laura Garcia Liebana <nevola@xxxxxxxxx>
---
configure.ac | 14 +++++++++++++-
include/hash.h | 10 ++++++++++
src/parser_bison.y | 5 +++++
tests/py/ip/hash.t | 2 ++
4 files changed, 30 insertions(+), 1 deletion(-)
diff --git a/configure.ac b/configure.ac
index 7e0b75c..8c93981 100644
--- a/configure.ac
+++ b/configure.ac
@@ -108,6 +108,17 @@ AC_DEFINE([HAVE_LIBXTABLES], [1], [0])
AC_SUBST(with_libxtables)
AM_CONDITIONAL([BUILD_XTABLES], [test "x$with_libxtables" == xyes])
+AC_ARG_WITH([arc4random], [AS_HELP_STRING([--without-arc4random],
+ [disable arc4random (libbsd dev support)])],
+ [], [with_arc4random=yes])
+AS_IF([test "x$with_arc4random" != xno], [
+AC_CHECK_LIB([bsd], [arc4random], ,
+ AC_MSG_ERROR([No suitable version of libbsd dev found]))
+AC_DEFINE([HAVE_LIBBSD], [1], [])
+])
+AC_SUBST(with_arc4random)
+AM_CONDITIONAL([BUILD_ARC4RANDOM], [test "x$with_arc4random" != xno])
+
# Checks for header files.
AC_HEADER_STDC
AC_HEADER_ASSERT
@@ -158,4 +169,5 @@ nft configuration:
enable debugging: ${with_debug}
use mini-gmp: ${with_mini_gmp}
enable pdf documentation: ${enable_pdf_doc}
- libxtables support: ${with_libxtables}"
+ libxtables support: ${with_libxtables}
+ arc4random support: ${with_arc4random}"
diff --git a/include/hash.h b/include/hash.h
index bc8c86a..5350cb2 100644
--- a/include/hash.h
+++ b/include/hash.h
@@ -1,6 +1,16 @@
#ifndef NFTABLES_HASH_H
#define NFTABLES_HASH_H
+#ifdef HAVE_LIBBSD
+#include <bsd/stdlib.h>
+#define getrandom() (arc4random() % ((uint32_t)RAND_MAX + 1))
+
+#else
+#include <time.h>
+#include <stdlib.h>
+#define getrandom() ({ srand(time(NULL)); (uint32_t)rand(); })
+#endif
+
extern struct expr *hash_expr_alloc(const struct location *loc,
uint32_t modulus, uint32_t seed);
diff --git a/src/parser_bison.y b/src/parser_bison.y
index 36dbc8d..0fa469d 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -2485,6 +2485,11 @@ hash_expr : JHASH expr MOD NUM SEED NUM
$$ = hash_expr_alloc(&@$, $4, $6);
$$->hash.expr = $2;
}
+ | JHASH expr MOD NUM
+ {
+ $$ = hash_expr_alloc(&@$, $4, getrandom());
+ $$->hash.expr = $2;
+ }
;
ct_expr : CT ct_key
diff --git a/tests/py/ip/hash.t b/tests/py/ip/hash.t
index 6dfa965..85f9b18 100644
--- a/tests/py/ip/hash.t
+++ b/tests/py/ip/hash.t
@@ -2,4 +2,6 @@
*ip;test-ip4;pre
ct mark set jhash ip saddr . ip daddr mod 2 seed 0xdeadbeef;ok
+ct mark set jhash ip saddr . ip daddr mod 2;ok
dnat to jhash ip saddr mod 2 seed 0xdeadbeef map { 0 : 192.168.20.100, 1 : 192.168.30.100 };ok
+dnat to jhash ip saddr mod 2 map { 0 : 192.168.20.100, 1 : 192.168.30.100 };ok
--
2.9.3
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
