On Wed, Apr 12, 2017 at 10:43 PM, Florian Westphal <fw@xxxxxxxxx> wrote:
> Liping Zhang <zlpnobody@xxxxxxxxx> wrote:
>> >> +++ b/net/netfilter/nft_hash.c
>> >> @@ -21,6 +21,7 @@ struct nft_hash {
>> >> enum nft_registers sreg:8;
>> >> enum nft_registers dreg:8;
>> >> u8 len;
>> >> + bool autogen_seed:1;
>> >
>> > Hi Liping, I don't think that hiding the seed value would be useful, and
>> > even adding this attribute doesn't worth it just to hide the seed.
>> >
>>
>> If we don't do this thing, if the user inputting the following nft rules:
>> # nft add rule x y ct mark set jhash ip saddr mod 2
>>
>> Then nft list ruleset will display something like this, where 0xd6ab633c
>> is very unpredictable, and the user doesn't care the seed at all:
>> ct mark set jhash ip saddr mod 2 seed 0xd6ab633c
>>
>> This will cause annoying complain when running "nft-test.py ip/hash.t".
>>
>> But another problem is this, I remember that Pablo is implementing a new
>> delete rule syntax, something like this:
>> "nft del rule x y ct mark set jhash ip saddr mod 2"
>>
>> The unpredictable seed will cause the above rule failed, since the seed
>> is not the same, so we cannot find a matched nft rule.
>
> FWIW I agree with Liping, we should eat the extra bool and
> supress seed dump.
>
> I also think most users should not ever have to even know of seed arg
> existence.
>
> In fact is there a use case where it is needed?
> We might want to ditch it completely and always just
> generate it privately in kernel (symhash f.e. uses
> a private seed) already.
In the case that is always generated in the kernel side, then we can
discard the seed parameter in nft and there is no need for an
additional bool.
Another option could be to relax the check of the seed attribute in
the tests and in the rules deletion.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
