Hi Laura,
2017-04-08 5:19 GMT+08:00 Laura García Liébana <laura.garcia@xxxxxxxxxxx>:
> On Mon, Apr 3, 2017 at 10:34 AM, Liping Zhang <zlpnobody@xxxxxxx> wrote:
>>
>> From: Liping Zhang <zlpnobody@xxxxxxxxx>
>>
>> This can prevent the nft utility from printing out the auto generated
>> seed to the user, which is unnecessary and confusing.
>>
>> Signed-off-by: Liping Zhang <zlpnobody@xxxxxxxxx>
>> ---
>> net/netfilter/nft_hash.c | 10 +++++++---
>> 1 file changed, 7 insertions(+), 3 deletions(-)
>>
>> diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
>> index eb2721a..c4dad12 100644
>> --- a/net/netfilter/nft_hash.c
>> +++ b/net/netfilter/nft_hash.c
>> @@ -21,6 +21,7 @@ struct nft_hash {
>> enum nft_registers sreg:8;
>> enum nft_registers dreg:8;
>> u8 len;
>> + bool autogen_seed:1;
>
> Hi Liping, I don't think that hiding the seed value would be useful, and
> even adding this attribute doesn't worth it just to hide the seed.
>
If we don't do this thing, if the user inputting the following nft rules:
# nft add rule x y ct mark set jhash ip saddr mod 2
Then nft list ruleset will display something like this, where 0xd6ab633c
is very unpredictable, and the user doesn't care the seed at all:
ct mark set jhash ip saddr mod 2 seed 0xd6ab633c
This will cause annoying complain when running "nft-test.py ip/hash.t".
But another problem is this, I remember that Pablo is implementing a new
delete rule syntax, something like this:
"nft del rule x y ct mark set jhash ip saddr mod 2"
The unpredictable seed will cause the above rule failed, since the seed
is not the same, so we cannot find a matched nft rule.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
