netfilter: nf_tables: add number generator expression

This patch adds the numgen expression that allows us to generated
incremental and random numbers, this generator is bound to a upper limit
that is specified by userspace.

This expression is useful to distribute packets in a round-robin fashion
as well as randomly.

Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 24 insertions, 0 deletions

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 784fbf15ab3d..8c9d6ff70ec0 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -1121,4 +1121,28 @@ enum nft_trace_types {
         __NFT_TRACETYPE_MAX
 };
 #define NFT_TRACETYPE_MAX (__NFT_TRACETYPE_MAX - 1)
+
+/**
+ * enum nft_ng_attributes - nf_tables number generator expression netlink attributes
+ *
+ * @NFTA_NG_DREG: destination register (NLA_U32)
+ * @NFTA_NG_UNTIL: source value to increment the counter until reset (NLA_U32)
+ * @NFTA_NG_TYPE: operation type (NLA_U32)
+ */
+enum nft_ng_attributes {
+        NFTA_NG_UNSPEC,
+        NFTA_NG_DREG,
+        NFTA_NG_UNTIL,
+        NFTA_NG_TYPE,
+        __NFTA_NG_MAX
+};
+#define NFTA_NG_MAX     (__NFTA_NG_MAX - 1)
+
+enum nft_ng_types {
+        NFT_NG_INCREMENTAL,
+        NFT_NG_RANDOM,
+        __NFT_NG_MAX
+};
+#define NFT_NG_MAX      (__NFT_NG_MAX - 1)
+
 #endif /* _LINUX_NF_TABLES_H */