meta: add random support

"meta random" fills a register with a 32bit pseudo-random number.

For instance one can now use

meta random <= 2147483647

... to match every 2nd packet on average.

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/meta.c b/src/meta.c
index 75431a2f3865bdbb6cee3adb495899e014fb824a..9dd91de389aef0a7ff08e0d8efbd19c6e67b579d 100644 (file)
--- a/src/meta.c
+++ b/src/meta.c
@@ -418,6 +418,9 @@ static const struct meta_template meta_templates[] = {
        [NFT_META_CGROUP]       = META_TEMPLATE("cgroup",    &integer_type,
                                                4 * BITS_PER_BYTE,
                                                BYTEORDER_HOST_ENDIAN),
+       [NFT_META_PRANDOM]      = META_TEMPLATE("random",    &integer_type,
+                                               4 * BITS_PER_BYTE,
+                                               BYTEORDER_BIG_ENDIAN), /* avoid conversion; doesn't have endianess */
 };
 
 static bool meta_key_is_qualified(enum nft_meta_keys key)
@@ -428,6 +431,7 @@ static bool meta_key_is_qualified(enum nft_meta_keys key)
        case NFT_META_L4PROTO:
        case NFT_META_PROTOCOL:
        case NFT_META_PRIORITY:
+       case NFT_META_PRANDOM:
                return true;
        default:
                return false;

diff --git a/src/parser_bison.y b/src/parser_bison.y
index 6a029d1cd80aea81c6d0ac9cd1b63a9f8d3176b0..119fd09cc70810ff9eafac42fbb7845a1edb3216 100644 (file)
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -2348,6 +2348,7 @@ meta_key_qualified        :       LENGTH          { $$ = NFT_META_LEN; }
                        |       L4PROTO         { $$ = NFT_META_L4PROTO; }
                        |       PROTOCOL        { $$ = NFT_META_PROTOCOL; }
                        |       PRIORITY        { $$ = NFT_META_PRIORITY; }
+                       |       RANDOM          { $$ = NFT_META_PRANDOM; }
                        ;
 
 meta_key_unqualified   :       MARK            { $$ = NFT_META_MARK; }