From 9ea81ca125949f6ee05f68057f6e0ac7286b27f0 Mon Sep 17 00:00:00 2001 From: Kyrylo Yatsenko Date: Sun, 31 Aug 2025 20:00:42 +0300 Subject: T75: ipt-netflow enable sampler, mac and vlan Enable sampler, MAC address and VLAN recording. For this to work two patches are needed: * 0001-Fix-prandom_u32-_max-get_random_u32-_below: fix interface updates for random numbers, took fix from https://github.com/aabc/ipt-netflow/commit/0c5759d002131ac3ae161713f4ce0d515037c1de * 0002-Fix-lu-llu-where-64bit: Fix lu -> llu for 64-bit fields --- .../linux-kernel/build-ipt-netflow.sh | 10 +- ...ix-prandom_u32-_max-get_random_u32-_below.patch | 184 +++++++++++++++++++++ .../ipt-netflow/0002-Fix-lu-llu-where-64bit.patch | 30 ++++ 3 files changed, 223 insertions(+), 1 deletion(-) create mode 100644 scripts/package-build/linux-kernel/patches/ipt-netflow/0001-Fix-prandom_u32-_max-get_random_u32-_below.patch create mode 100644 scripts/package-build/linux-kernel/patches/ipt-netflow/0002-Fix-lu-llu-where-64bit.patch (limited to 'scripts/package-build/linux-kernel') diff --git a/scripts/package-build/linux-kernel/build-ipt-netflow.sh b/scripts/package-build/linux-kernel/build-ipt-netflow.sh index 9245a416..f1df2d99 100755 --- a/scripts/package-build/linux-kernel/build-ipt-netflow.sh +++ b/scripts/package-build/linux-kernel/build-ipt-netflow.sh @@ -19,6 +19,14 @@ if [ -d .git ]; then git clean --force -d -x fi +# Possibly making fork makes more sense in this case?.. +PATCH_DIR=${CWD}/patches/ipt-netflow +for patch in $(ls ${PATCH_DIR}) +do + echo "I: Apply ipt-netflow patch: ${PATCH_DIR}/${patch}" + patch -p1 < ${PATCH_DIR}/${patch} +done + . ${KERNEL_VAR_FILE} DRIVER_VERSION=$(git describe | sed s/^v//) @@ -29,7 +37,7 @@ DEBIAN_DIR="tmp/" DEBIAN_CONTROL="${DEBIAN_DIR}/DEBIAN/control" DEBIAN_POSTINST="${CWD}/vyos-ipt-netflow.postinst" -./configure --enable-aggregation --kdir=${KERNEL_DIR} +./configure --enable-macaddress --enable-vlan --enable-sampler --enable-aggregation --kdir=${KERNEL_DIR} make all if [ "x$?" != "x0" ]; then diff --git a/scripts/package-build/linux-kernel/patches/ipt-netflow/0001-Fix-prandom_u32-_max-get_random_u32-_below.patch b/scripts/package-build/linux-kernel/patches/ipt-netflow/0001-Fix-prandom_u32-_max-get_random_u32-_below.patch new file mode 100644 index 00000000..a7e8a909 --- /dev/null +++ b/scripts/package-build/linux-kernel/patches/ipt-netflow/0001-Fix-prandom_u32-_max-get_random_u32-_below.patch @@ -0,0 +1,184 @@ +From 4afd69cf67de6f48bf54bce4a248c60b36078fe8 Mon Sep 17 00:00:00 2001 +From: Jaco Kroon +Date: Mon, 17 Mar 2025 16:43:30 +0200 +Subject: [PATCH 1/2] Fix prandom_u32{,_max} => get_random_u32{,_below} + +For backwards compatiblity this gets pretty nasty. This should work +fairly well. + +Signed-off-by: Jaco Kroon +--- + compat.h | 33 +++++++++++++++++++++++++-------- + gen_compat_def | 44 ++++++++++++++++++++++++++++++++++++++------ + ipt_NETFLOW.c | 6 +++--- + 3 files changed, 66 insertions(+), 17 deletions(-) + +diff --git a/compat.h b/compat.h +index 8461c3d..b44f861 100644 +--- a/compat.h ++++ b/compat.h +@@ -108,17 +108,34 @@ union nf_inet_addr { + # define time_is_after_jiffies(a) time_before(jiffies, a) + #endif + +-#if LINUX_VERSION_CODE < KERNEL_VERSION(3,14,0) +-# if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,19) +-# define prandom_u32 get_random_int +-# elif LINUX_VERSION_CODE < KERNEL_VERSION(3,8,0) +-# define prandom_u32 random32 ++#ifndef HAVE_GET_RANDOM_U32 ++# ifdef HAVE_PRANDOM_U32 ++# ifdef HAVE_PRANDOM_H ++# include ++# endif ++static inline u32 get_random_u32() { ++ return prandom_u32(); ++} ++# else ++# pragma error Need fallback for get_random_u32 ++# endif + #endif +-#define prandom_u32_max compat_prandom_u32_max +-static inline u32 prandom_u32_max(u32 ep_ro) ++ ++#ifndef HAVE_GET_RANDOM_U32_BELOW ++# ifdef HAVE_PRANDOM_U32_MAX ++# ifdef HAVE_PRANDOM_H ++# include ++# endif ++static inline u32 get_random_u32_below(u32 ep_ro) + { +- return (u32)(((u64) prandom_u32() * ep_ro) >> 32); ++ return prandom_u32_max(ep_ro); + } ++# else ++static inline u32 get_random_u32_below(u32 ep_ro) ++{ ++ return (u32)(((u64) get_random_u32() * ep_ro) >> 32); ++} ++# endif + #endif + + #ifndef min_not_zero +diff --git a/gen_compat_def b/gen_compat_def +index a9cb95e..6440d5c 100755 +--- a/gen_compat_def ++++ b/gen_compat_def +@@ -1,4 +1,4 @@ +-#!/bin/bash -efu ++#!/bin/bash -fu + # SPDX-License-Identifier: GPL-2.0-only + # + # Generate defines based on kernel having some symbols declared. +@@ -21,7 +21,7 @@ WD=cc-test-build + mkdir -p $WD + cd ./$WD || fatal "cannot cd to $WD" + +-# args: HAVE_SUMBOL symbol include ++# args: HAVE_SYMBOL symbol [include] [success] [failure] + kbuild_test_compile() { + local cmd + +@@ -30,14 +30,15 @@ kbuild_test_compile() { + cmd="make -s -B -C $KDIR M=$PWD modules" + echo "$cmd" > log + if $cmd >> log 2>&1; then +- echo " declared" >&2 +- [ "$2" ] && echo "// $2 is declared ${3:+in <$3>}" ++ echo " ${4-declared}" >&2 ++ [ "$2" ] && echo "// $2 ${4-is declared}${3:+ in <$3>}" + echo "#define HAVE_$1" + echo ++ return 0 + else +- echo " undeclared" >&2 ++ echo " ${5-undeclared}" >&2 + echo "#undef HAVE_$1" +- echo "// ${2:-symbol} is undeclared${3:+ in <$3>}. Compile:" ++ echo "// ${2:-symbol} ${5-is undeclared}${3:+ in <$3>}. Compile:" + sed "s/^/\/\/ /" test.c + echo "// Output:" + sed "s/^/\/\/ /" log +@@ -56,6 +57,7 @@ kbuild_test_compile() { + echo >&2 + exit 3 + fi ++ return 1 + fi + } + +@@ -105,6 +107,22 @@ kbuild_test_member() { + typeof(((struct $structname*)0)->$member) test; + EOF + } ++ ++# Test that a header is available/exist ++kbuild_test_header() { ++ echo -n "Test header $*" >&2 ++ structname=${1%.*} ++ member=${1#*.} ++ def=${1^^} ++ def=${def##*/} ++ def=${def//./_} ++ kbuild_test_compile $def "header $1" "" "exists" "doesn't exist" <<-EOF ++ #include ++ #include <$1> ++ MODULE_LICENSE("GPL"); ++ EOF ++} ++ + echo "// Autogenerated for $KDIR" + echo + +@@ -129,6 +147,20 @@ kbuild_test_ref totalram_pages linux/mm.h + kbuild_test_member nf_ct_event_notifier.ct_event net/netfilter/nf_conntrack_ecache.h + # 6.4: 0199849acd07 ("sysctl: remove register_sysctl_paths()") + kbuild_test_symbol register_sysctl_paths linux/sysctl.h ++# Do we have get_random_u32_below ++kbuild_test_symbol get_random_u32_below linux/random.h ++# Do we have get_random_u32 ++kbuild_test_symbol get_random_u32 linux/random.h ++ ++# prandom functions moved from random.h to prandom.h recentish. ++# We use these for fallback for the above only. ++if kbuild_test_header linux/prandom.h; then ++ prand_h=linux/prandom.h ++else ++ prand_h=linux/random.h ++fi ++kbuild_test_symbol prandom_u32 $prand_h ++kbuild_test_symbol prandom_u32_max $prand_h + + echo "// End of compat_def.h" + +diff --git a/ipt_NETFLOW.c b/ipt_NETFLOW.c +index eee8074..fefe809 100644 +--- a/ipt_NETFLOW.c ++++ b/ipt_NETFLOW.c +@@ -4454,7 +4454,7 @@ static int netflow_scan_and_export(const int flush) + val = nf->sampler_count % interval; + break; + case SAMPLER_RANDOM: +- val = prandom_u32_max(interval); ++ val = get_random_u32_below(interval); + break; + default: /* SAMPLER_HASH */ + val = 0; +@@ -5709,12 +5709,12 @@ static int __init ipt_netflow_init(void) + } + parse_sampler(sampler); + #ifdef SAMPLING_HASH +- hash_seed = prandom_u32(); ++ hash_seed = get_random_u32(); + #endif + #endif + + #ifdef ENABLE_RANDOM_TEMPLATE_IDS +- template_ids = FLOWSET_DATA_FIRST | prandom_u32_max(0x00010000); ++ template_ids = FLOWSET_DATA_FIRST | get_random_u32_below(0x00010000); + #endif + + #ifdef SNMP_RULES +-- +2.50.1 + diff --git a/scripts/package-build/linux-kernel/patches/ipt-netflow/0002-Fix-lu-llu-where-64bit.patch b/scripts/package-build/linux-kernel/patches/ipt-netflow/0002-Fix-lu-llu-where-64bit.patch new file mode 100644 index 00000000..f28ab062 --- /dev/null +++ b/scripts/package-build/linux-kernel/patches/ipt-netflow/0002-Fix-lu-llu-where-64bit.patch @@ -0,0 +1,30 @@ +From b2e39db56640ba7d437a5edbd67889425969623e Mon Sep 17 00:00:00 2001 +From: Kyrylo Yatsenko +Date: Sat, 30 Aug 2025 22:20:02 +0300 +Subject: [PATCH 2/2] Fix lu -> llu where 64bit + +--- + ipt_NETFLOW.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/ipt_NETFLOW.c b/ipt_NETFLOW.c +index fefe809..08e9442 100644 +--- a/ipt_NETFLOW.c ++++ b/ipt_NETFLOW.c +@@ -759,11 +759,11 @@ static int nf_seq_show(struct seq_file *seq, void *v) + sampler_mode_string(), + get_sampler_interval()); + if (get_sampler_mode() != SAMPLER_HASH) +- seq_printf(seq, " Flows selected %lu, discarded %lu.", ++ seq_printf(seq, " Flows selected %llu, discarded %llu.", + atomic64_read(&flows_selected), + atomic64_read(&flows_observed) - atomic64_read(&flows_selected)); + else +- seq_printf(seq, " Flows selected %lu.", atomic64_read(&flows_selected)); ++ seq_printf(seq, " Flows selected %llu.", atomic64_read(&flows_selected)); + seq_printf(seq, " Pkts selected %llu, discarded %llu.\n", + t.pkts_selected, + t.pkts_observed - t.pkts_selected); +-- +2.50.1 + -- cgit v1.2.3 From 3c435753698f79a88fba277f9df2b16db73f0473 Mon Sep 17 00:00:00 2001 From: Kyrylo Yatsenko Date: Mon, 1 Sep 2025 20:07:09 +0300 Subject: T75: ipt-netflow enable direction + fix vlan out * add --enable-direction as requested * Fix output of `cat /proc/net/stat/ipt_netflow_flows`: previously if no VLAN, there was no output and table columns were shifted when parsed. --- .../linux-kernel/build-ipt-netflow.sh | 2 +- ...lows_dump_seq_show-fix-table-when-no-VLAN.patch | 27 ++++++++++++++++++++++ 2 files changed, 28 insertions(+), 1 deletion(-) create mode 100644 scripts/package-build/linux-kernel/patches/ipt-netflow/0003-flows_dump_seq_show-fix-table-when-no-VLAN.patch (limited to 'scripts/package-build/linux-kernel') diff --git a/scripts/package-build/linux-kernel/build-ipt-netflow.sh b/scripts/package-build/linux-kernel/build-ipt-netflow.sh index f1df2d99..bae4051b 100755 --- a/scripts/package-build/linux-kernel/build-ipt-netflow.sh +++ b/scripts/package-build/linux-kernel/build-ipt-netflow.sh @@ -37,7 +37,7 @@ DEBIAN_DIR="tmp/" DEBIAN_CONTROL="${DEBIAN_DIR}/DEBIAN/control" DEBIAN_POSTINST="${CWD}/vyos-ipt-netflow.postinst" -./configure --enable-macaddress --enable-vlan --enable-sampler --enable-aggregation --kdir=${KERNEL_DIR} +./configure --enable-direction --enable-macaddress --enable-vlan --enable-sampler --enable-aggregation --kdir=${KERNEL_DIR} make all if [ "x$?" != "x0" ]; then diff --git a/scripts/package-build/linux-kernel/patches/ipt-netflow/0003-flows_dump_seq_show-fix-table-when-no-VLAN.patch b/scripts/package-build/linux-kernel/patches/ipt-netflow/0003-flows_dump_seq_show-fix-table-when-no-VLAN.patch new file mode 100644 index 00000000..df3192f9 --- /dev/null +++ b/scripts/package-build/linux-kernel/patches/ipt-netflow/0003-flows_dump_seq_show-fix-table-when-no-VLAN.patch @@ -0,0 +1,27 @@ +From a4f8dda069dfce77e6ef0764de476dfdca7dc812 Mon Sep 17 00:00:00 2001 +From: Kyrylo Yatsenko +Date: Mon, 1 Sep 2025 19:57:27 +0300 +Subject: [PATCH] flows_dump_seq_show: fix table when no VLAN + +When no VLAN nothing was output, so columns were off. +Output "-" when no VLAN. +--- + ipt_NETFLOW.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/ipt_NETFLOW.c b/ipt_NETFLOW.c +index eee8074..ca4d0f2 100644 +--- a/ipt_NETFLOW.c ++++ b/ipt_NETFLOW.c +@@ -1153,6 +1153,8 @@ static int flows_dump_seq_show(struct seq_file *seq, void *v) + seq_printf(seq, " %d", ntohs(nf->tuple.tag[0])); + if (nf->tuple.tag[1]) + seq_printf(seq, ",%d", ntohs(nf->tuple.tag[1])); ++ } else { ++ seq_printf(seq, " -"); + } + #endif + #if defined(ENABLE_MAC) || defined(ENABLE_VLAN) +-- +2.50.1 + -- cgit v1.2.3