Merge pull request #1022 from hedrok/T75-ipt-netflow-add-sampler

T75: ipt-netflow enable sampler, mac and vlan

4 files changed, 250 insertions, 1 deletions

diff --git a/scripts/package-build/linux-kernel/build-ipt-netflow.sh b/scripts/package-build/linux-kernel/build-ipt-netflow.sh
index 9245a416..bae4051b 100755
--- a/scripts/package-build/linux-kernel/build-ipt-netflow.sh
+++ b/scripts/package-build/linux-kernel/build-ipt-netflow.sh
@@ -19,6 +19,14 @@ if [ -d .git ]; then
     git clean --force -d -x
 fi
 
+# Possibly making fork makes more sense in this case?..
+PATCH_DIR=${CWD}/patches/ipt-netflow
+for patch in $(ls ${PATCH_DIR})
+do
+    echo "I: Apply ipt-netflow patch: ${PATCH_DIR}/${patch}"
+    patch -p1 < ${PATCH_DIR}/${patch}
+done
+
 . ${KERNEL_VAR_FILE}
 
 DRIVER_VERSION=$(git describe | sed s/^v//)
@@ -29,7 +37,7 @@ DEBIAN_DIR="tmp/"
 DEBIAN_CONTROL="${DEBIAN_DIR}/DEBIAN/control"
 DEBIAN_POSTINST="${CWD}/vyos-ipt-netflow.postinst"
 
-./configure --enable-aggregation --kdir=${KERNEL_DIR}
+./configure --enable-direction --enable-macaddress --enable-vlan --enable-sampler --enable-aggregation --kdir=${KERNEL_DIR}
 make all
 
 if [ "x$?" != "x0" ]; then
diff --git a/scripts/package-build/linux-kernel/patches/ipt-netflow/0001-Fix-prandom_u32-_max-get_random_u32-_below.patch b/scripts/package-build/linux-kernel/patches/ipt-netflow/0001-Fix-prandom_u32-_max-get_random_u32-_below.patch
new file mode 100644
index 00000000..a7e8a909
--- /dev/null
+++ b/scripts/package-build/linux-kernel/patches/ipt-netflow/0001-Fix-prandom_u32-_max-get_random_u32-_below.patch
@@ -0,0 +1,184 @@
+From 4afd69cf67de6f48bf54bce4a248c60b36078fe8 Mon Sep 17 00:00:00 2001
+From: Jaco Kroon <jaco@uls.co.za>
+Date: Mon, 17 Mar 2025 16:43:30 +0200
+Subject: [PATCH 1/2] Fix prandom_u32{,_max} => get_random_u32{,_below}
+
+For backwards compatiblity this gets pretty nasty.  This should work
+fairly well.
+
+Signed-off-by: Jaco Kroon <jaco@uls.co.za>
+---
+ compat.h       | 33 +++++++++++++++++++++++++--------
+ gen_compat_def | 44 ++++++++++++++++++++++++++++++++++++++------
+ ipt_NETFLOW.c  |  6 +++---
+ 3 files changed, 66 insertions(+), 17 deletions(-)
+
+diff --git a/compat.h b/compat.h
+index 8461c3d..b44f861 100644
+--- a/compat.h
++++ b/compat.h
+@@ -108,17 +108,34 @@ union nf_inet_addr {
+ # define time_is_after_jiffies(a) time_before(jiffies, a)
+ #endif
+ 
+-#if LINUX_VERSION_CODE < KERNEL_VERSION(3,14,0)
+-# if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19)
+-#  define prandom_u32 get_random_int
+-# elif LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0)
+-#  define prandom_u32 random32
++#ifndef HAVE_GET_RANDOM_U32
++# ifdef HAVE_PRANDOM_U32
++#  ifdef HAVE_PRANDOM_H
++#   include <linux/prandom.h>
++#  endif
++static inline u32 get_random_u32() {
++	return prandom_u32();
++}
++# else
++#  pragma error Need fallback for get_random_u32
++# endif
+ #endif
+-#define prandom_u32_max compat_prandom_u32_max
+-static inline u32 prandom_u32_max(u32 ep_ro)
++
++#ifndef HAVE_GET_RANDOM_U32_BELOW
++# ifdef HAVE_PRANDOM_U32_MAX
++#  ifdef HAVE_PRANDOM_H
++#   include <linux/prandom.h>
++#  endif
++static inline u32 get_random_u32_below(u32 ep_ro)
+ {
+-	return (u32)(((u64) prandom_u32() * ep_ro) >> 32);
++	return prandom_u32_max(ep_ro);
+ }
++# else
++static inline u32 get_random_u32_below(u32 ep_ro)
++{
++	return (u32)(((u64) get_random_u32() * ep_ro) >> 32);
++}
++# endif
+ #endif
+ 
+ #ifndef min_not_zero
+diff --git a/gen_compat_def b/gen_compat_def
+index a9cb95e..6440d5c 100755
+--- a/gen_compat_def
++++ b/gen_compat_def
+@@ -1,4 +1,4 @@
+-#!/bin/bash -efu
++#!/bin/bash -fu
+ # SPDX-License-Identifier: GPL-2.0-only
+ #
+ # Generate defines based on kernel having some symbols declared.
+@@ -21,7 +21,7 @@ WD=cc-test-build
+ mkdir -p $WD
+ cd ./$WD || fatal "cannot cd to $WD"
+ 
+-# args: HAVE_SUMBOL symbol include
++# args: HAVE_SYMBOL symbol [include] [success] [failure]
+ kbuild_test_compile() {
+   local cmd
+ 
+@@ -30,14 +30,15 @@ kbuild_test_compile() {
+   cmd="make -s -B -C $KDIR M=$PWD modules"
+   echo "$cmd" > log
+   if $cmd >> log 2>&1; then
+-    echo " declared" >&2
+-    [ "$2" ] && echo "// $2 is declared ${3:+in <$3>}"
++    echo " ${4-declared}" >&2
++    [ "$2" ] && echo "// $2 ${4-is declared}${3:+ in <$3>}"
+     echo "#define HAVE_$1"
+     echo
++    return 0
+   else
+-    echo " undeclared" >&2
++    echo " ${5-undeclared}" >&2
+     echo "#undef HAVE_$1"
+-    echo "// ${2:-symbol} is undeclared${3:+ in <$3>}. Compile:"
++    echo "// ${2:-symbol} ${5-is undeclared}${3:+ in <$3>}. Compile:"
+     sed  "s/^/\/\/   /" test.c
+     echo "// Output:"
+     sed  "s/^/\/\/   /" log
+@@ -56,6 +57,7 @@ kbuild_test_compile() {
+       echo >&2
+       exit 3
+     fi
++    return 1
+   fi
+ }
+ 
+@@ -105,6 +107,22 @@ kbuild_test_member() {
+ 	typeof(((struct $structname*)0)->$member) test;
+ 	EOF
+ }
++
++# Test that a header is available/exist
++kbuild_test_header() {
++  echo -n "Test header $*" >&2
++  structname=${1%.*}
++  member=${1#*.}
++  def=${1^^}
++  def=${def##*/}
++  def=${def//./_}
++  kbuild_test_compile $def "header $1" "" "exists" "doesn't exist" <<-EOF
++	#include <linux/module.h>
++	#include <$1>
++	MODULE_LICENSE("GPL");
++	EOF
++}
++
+ echo "// Autogenerated for $KDIR"
+ echo
+ 
+@@ -129,6 +147,20 @@ kbuild_test_ref    totalram_pages linux/mm.h
+ kbuild_test_member nf_ct_event_notifier.ct_event net/netfilter/nf_conntrack_ecache.h
+ # 6.4: 0199849acd07 ("sysctl: remove register_sysctl_paths()")
+ kbuild_test_symbol register_sysctl_paths linux/sysctl.h
++# Do we have get_random_u32_below
++kbuild_test_symbol get_random_u32_below linux/random.h
++# Do we have get_random_u32
++kbuild_test_symbol get_random_u32 linux/random.h
++
++# prandom functions moved from random.h to prandom.h recentish.
++# We use these for fallback for the above only.
++if kbuild_test_header linux/prandom.h; then
++  prand_h=linux/prandom.h
++else
++  prand_h=linux/random.h
++fi
++kbuild_test_symbol prandom_u32 $prand_h
++kbuild_test_symbol prandom_u32_max $prand_h
+ 
+ echo "// End of compat_def.h"
+ 
+diff --git a/ipt_NETFLOW.c b/ipt_NETFLOW.c
+index eee8074..fefe809 100644
+--- a/ipt_NETFLOW.c
++++ b/ipt_NETFLOW.c
+@@ -4454,7 +4454,7 @@ static int netflow_scan_and_export(const int flush)
+ 				val = nf->sampler_count % interval;
+ 				break;
+ 			case SAMPLER_RANDOM:
+-				val = prandom_u32_max(interval);
++				val = get_random_u32_below(interval);
+ 				break;
+ 			default: /* SAMPLER_HASH */
+ 				val = 0;
+@@ -5709,12 +5709,12 @@ static int __init ipt_netflow_init(void)
+ 	}
+ 	parse_sampler(sampler);
+ #ifdef SAMPLING_HASH
+-	hash_seed = prandom_u32();
++	hash_seed = get_random_u32();
+ #endif
+ #endif
+ 
+ #ifdef ENABLE_RANDOM_TEMPLATE_IDS
+-	template_ids = FLOWSET_DATA_FIRST | prandom_u32_max(0x00010000);
++	template_ids = FLOWSET_DATA_FIRST | get_random_u32_below(0x00010000);
+ #endif
+ 
+ #ifdef SNMP_RULES
+-- 
+2.50.1
+
diff --git a/scripts/package-build/linux-kernel/patches/ipt-netflow/0002-Fix-lu-llu-where-64bit.patch b/scripts/package-build/linux-kernel/patches/ipt-netflow/0002-Fix-lu-llu-where-64bit.patch
new file mode 100644
index 00000000..f28ab062
--- /dev/null
+++ b/scripts/package-build/linux-kernel/patches/ipt-netflow/0002-Fix-lu-llu-where-64bit.patch
@@ -0,0 +1,30 @@
+From b2e39db56640ba7d437a5edbd67889425969623e Mon Sep 17 00:00:00 2001
+From: Kyrylo Yatsenko <hedrok@gmail.com>
+Date: Sat, 30 Aug 2025 22:20:02 +0300
+Subject: [PATCH 2/2] Fix lu -> llu where 64bit
+
+---
+ ipt_NETFLOW.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ipt_NETFLOW.c b/ipt_NETFLOW.c
+index fefe809..08e9442 100644
+--- a/ipt_NETFLOW.c
++++ b/ipt_NETFLOW.c
+@@ -759,11 +759,11 @@ static int nf_seq_show(struct seq_file *seq, void *v)
+ 		    sampler_mode_string(),
+ 		    get_sampler_interval());
+ 		if (get_sampler_mode() != SAMPLER_HASH)
+-			seq_printf(seq, " Flows selected %lu, discarded %lu.",
++			seq_printf(seq, " Flows selected %llu, discarded %llu.",
+ 			    atomic64_read(&flows_selected),
+ 			    atomic64_read(&flows_observed) - atomic64_read(&flows_selected));
+ 		else
+-			seq_printf(seq, " Flows selected %lu.", atomic64_read(&flows_selected));
++			seq_printf(seq, " Flows selected %llu.", atomic64_read(&flows_selected));
+ 		seq_printf(seq, " Pkts selected %llu, discarded %llu.\n",
+ 		    t.pkts_selected,
+ 		    t.pkts_observed - t.pkts_selected);
+-- 
+2.50.1
+
diff --git a/scripts/package-build/linux-kernel/patches/ipt-netflow/0003-flows_dump_seq_show-fix-table-when-no-VLAN.patch b/scripts/package-build/linux-kernel/patches/ipt-netflow/0003-flows_dump_seq_show-fix-table-when-no-VLAN.patch
new file mode 100644
index 00000000..df3192f9
--- /dev/null
+++ b/scripts/package-build/linux-kernel/patches/ipt-netflow/0003-flows_dump_seq_show-fix-table-when-no-VLAN.patch
@@ -0,0 +1,27 @@
+From a4f8dda069dfce77e6ef0764de476dfdca7dc812 Mon Sep 17 00:00:00 2001
+From: Kyrylo Yatsenko <hedrok@gmail.com>
+Date: Mon, 1 Sep 2025 19:57:27 +0300
+Subject: [PATCH] flows_dump_seq_show: fix table when no VLAN
+
+When no VLAN nothing was output, so columns were off.
+Output "-" when no VLAN.
+---
+ ipt_NETFLOW.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/ipt_NETFLOW.c b/ipt_NETFLOW.c
+index eee8074..ca4d0f2 100644
+--- a/ipt_NETFLOW.c
++++ b/ipt_NETFLOW.c
+@@ -1153,6 +1153,8 @@ static int flows_dump_seq_show(struct seq_file *seq, void *v)
+ 		seq_printf(seq, " %d", ntohs(nf->tuple.tag[0]));
+ 		if (nf->tuple.tag[1])
+ 			seq_printf(seq, ",%d", ntohs(nf->tuple.tag[1]));
++	} else {
++		seq_printf(seq, " -");
+ 	}
+ #endif
+ #if defined(ENABLE_MAC) || defined(ENABLE_VLAN)
+-- 
+2.50.1
+