Liping Zhang <zlpnobody@xxxxxxxxx> wrote:
> >> +++ b/net/netfilter/nft_hash.c
> >> @@ -21,6 +21,7 @@ struct nft_hash {
> >> enum nft_registers sreg:8;
> >> enum nft_registers dreg:8;
> >> u8 len;
> >> + bool autogen_seed:1;
> >
> > Hi Liping, I don't think that hiding the seed value would be useful, and
> > even adding this attribute doesn't worth it just to hide the seed.
> >
>
> If we don't do this thing, if the user inputting the following nft rules:
> # nft add rule x y ct mark set jhash ip saddr mod 2
>
> Then nft list ruleset will display something like this, where 0xd6ab633c
> is very unpredictable, and the user doesn't care the seed at all:
> ct mark set jhash ip saddr mod 2 seed 0xd6ab633c
>
> This will cause annoying complain when running "nft-test.py ip/hash.t".
>
> But another problem is this, I remember that Pablo is implementing a new
> delete rule syntax, something like this:
> "nft del rule x y ct mark set jhash ip saddr mod 2"
>
> The unpredictable seed will cause the above rule failed, since the seed
> is not the same, so we cannot find a matched nft rule.
FWIW I agree with Liping, we should eat the extra bool and
supress seed dump.
I also think most users should not ever have to even know of seed arg
existence.
In fact is there a use case where it is needed?
We might want to ditch it completely and always just
generate it privately in kernel (symhash f.e. uses
a private seed) already.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
