This patch provides symmetric hash support according to source ip address and port, and destination ip address and port. For this purpose, the __skb_get_hash_symmetric() is used to identify the flow as it uses FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL flag by default. The new attribute NFTA_HASH_TYPE has been included to support different types of hashing functions. Currently supported NFT_HASH_JENKINS through jhash and NFT_HASH_SYM through symhash. The main difference between both types are: - jhash requires an expression with sreg, symhash doesn't. - symhash supports modulus and offset, but not seed. Examples: nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2 nft add rule ip nat prerouting ct mark set symhash mod 2 By default, jenkins hash will be used if no hash type is provided for compatibility reasons.
Unified · Split
| @@ -815,6 +815,17 @@ enum nft_rt_keys { · 814 unmodified lines | ||
| 815 | 815 | NFT_RT_NEXTHOP6, |
| 816 | 816 | }; |
| 817 | 817 | |
| 818 | +/** | |
| 819 | + * enum nft_hash_types - nf_tables hash expression types | |
| 820 | + * | |
| 821 | + * @NFT_HASH_JENKINS: Jenkins Hash | |
| 822 | + * @NFT_HASH_SYM: Symmetric Hash | |
| 823 | + */ | |
| 824 | +enum nft_hash_types { | |
| 825 | + NFT_HASH_JENKINS, | |
| 826 | + NFT_HASH_SYM, | |
| 827 | +}; | |
| 828 | + | |
| 818 | 829 | /** |
| 819 | 830 | * enum nft_hash_attributes - nf_tables hash expression netlink attributes |
| 820 | 831 | * |
| @@ -824,6 +835,7 @@ enum nft_rt_keys { · 3 unmodified lines | ||
| 824 | 835 | * @NFTA_HASH_MODULUS: modulus value (NLA_U32) |
| 825 | 836 | * @NFTA_HASH_SEED: seed value (NLA_U32) |
| 826 | 837 | * @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32) |
| 838 | + * @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types) | |
| 827 | 839 | */ |
| 828 | 840 | enum nft_hash_attributes { |
| 829 | 841 | NFTA_HASH_UNSPEC, |
| @@ -833,6 +845,7 @@ enum nft_hash_attributes { · 3 unmodified lines | ||
| 833 | 845 | NFTA_HASH_MODULUS, |
| 834 | 846 | NFTA_HASH_SEED, |
| 835 | 847 | NFTA_HASH_OFFSET, |
| 848 | + NFTA_HASH_TYPE, | |
| 836 | 849 | __NFTA_HASH_MAX, |
| 837 | 850 | }; |
| 838 | 851 | #define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1) |
| @@ -38,6 +38,25 @@ static void nft_jhash_eval(const struct nft_expr *expr, · 37 unmodified lines | ||
| 38 | 38 | regs->data[priv->dreg] = h + priv->offset; |
| 39 | 39 | } |
| 40 | 40 | |
| 41 | +struct nft_symhash { | |
| 42 | + enum nft_registers dreg:8; | |
| 43 | + u32 modulus; | |
| 44 | + u32 offset; | |
| 45 | +}; | |
| 46 | + | |
| 47 | +static void nft_symhash_eval(const struct nft_expr *expr, | |
| 48 | + struct nft_regs *regs, | |
| 49 | + const struct nft_pktinfo *pkt) | |
| 50 | +{ | |
| 51 | + struct nft_symhash *priv = nft_expr_priv(expr); | |
| 52 | + struct sk_buff *skb = pkt->skb; | |
| 53 | + u32 h; | |
| 54 | + | |
| 55 | + h = reciprocal_scale(__skb_get_hash_symmetric(skb), priv->modulus); | |
| 56 | + | |
| 57 | + regs->data[priv->dreg] = h + priv->offset; | |
| 58 | +} | |
| 59 | + | |
| 41 | 60 | static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = { |
| 42 | 61 | [NFTA_HASH_SREG] = { .type = NLA_U32 }, |
| 43 | 62 | [NFTA_HASH_DREG] = { .type = NLA_U32 }, |
| @@ -45,6 +64,7 @@ static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = { · 1 unmodified line | ||
| 45 | 64 | [NFTA_HASH_MODULUS] = { .type = NLA_U32 }, |
| 46 | 65 | [NFTA_HASH_SEED] = { .type = NLA_U32 }, |
| 47 | 66 | [NFTA_HASH_OFFSET] = { .type = NLA_U32 }, |
| 67 | + [NFTA_HASH_TYPE] = { .type = NLA_U32 }, | |
| 48 | 68 | }; |
| 49 | 69 | |
| 50 | 70 | static int nft_jhash_init(const struct nft_ctx *ctx, |
| @@ -92,6 +112,32 @@ static int nft_jhash_init(const struct nft_ctx *ctx, · 41 unmodified lines | ||
| 92 | 112 | NFT_DATA_VALUE, sizeof(u32)); |
| 93 | 113 | } |
| 94 | 114 | |
| 115 | +static int nft_symhash_init(const struct nft_ctx *ctx, | |
| 116 | + const struct nft_expr *expr, | |
| 117 | + const struct nlattr * const tb[]) | |
| 118 | +{ | |
| 119 | + struct nft_symhash *priv = nft_expr_priv(expr); | |
| 120 | + | |
| 121 | + if (!tb[NFTA_HASH_DREG] || | |
| 122 | + !tb[NFTA_HASH_MODULUS]) | |
| 123 | + return -EINVAL; | |
| 124 | + | |
| 125 | + if (tb[NFTA_HASH_OFFSET]) | |
| 126 | + priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET])); | |
| 127 | + | |
| 128 | + priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]); | |
| 129 | + | |
| 130 | + priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS])); | |
| 131 | + if (priv->modulus <= 1) | |
| 132 | + return -ERANGE; | |
| 133 | + | |
| 134 | + if (priv->offset + priv->modulus - 1 < priv->offset) | |
| 135 | + return -EOVERFLOW; | |
| 136 | + | |
| 137 | + return nft_validate_register_store(ctx, priv->dreg, NULL, | |
| 138 | + NFT_DATA_VALUE, sizeof(u32)); | |
| 139 | +} | |
| 140 | + | |
| 95 | 141 | static int nft_jhash_dump(struct sk_buff *skb, |
| 96 | 142 | const struct nft_expr *expr) |
| 97 | 143 | { |
| @@ -110,6 +156,28 @@ static int nft_jhash_dump(struct sk_buff *skb, · 12 unmodified lines | ||
| 110 | 156 | if (priv->offset != 0) |
| 111 | 157 | if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset))) |
| 112 | 158 | goto nla_put_failure; |
| 159 | + if (nla_put_be32(skb, NFTA_HASH_TYPE, htonl(NFT_HASH_JENKINS))) | |
| 160 | + goto nla_put_failure; | |
| 161 | + return 0; | |
| 162 | + | |
| 163 | +nla_put_failure: | |
| 164 | + return -1; | |
| 165 | +} | |
| 166 | + | |
| 167 | +static int nft_symhash_dump(struct sk_buff *skb, | |
| 168 | + const struct nft_expr *expr) | |
| 169 | +{ | |
| 170 | + const struct nft_symhash *priv = nft_expr_priv(expr); | |
| 171 | + | |
| 172 | + if (nft_dump_register(skb, NFTA_HASH_DREG, priv->dreg)) | |
| 173 | + goto nla_put_failure; | |
| 174 | + if (nla_put_be32(skb, NFTA_HASH_MODULUS, htonl(priv->modulus))) | |
| 175 | + goto nla_put_failure; | |
| 176 | + if (priv->offset != 0) | |
| 177 | + if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset))) | |
| 178 | + goto nla_put_failure; | |
| 179 | + if (nla_put_be32(skb, NFTA_HASH_TYPE, htonl(NFT_HASH_SYM))) | |
| 180 | + goto nla_put_failure; | |
| 113 | 181 | return 0; |
| 114 | 182 | |
| 115 | 183 | nla_put_failure: |
| @@ -125,9 +193,38 @@ static const struct nft_expr_ops nft_jhash_ops = { · 9 unmodified lines | ||
| 125 | 193 | .dump = nft_jhash_dump, |
| 126 | 194 | }; |
| 127 | 195 | |
| 196 | +static const struct nft_expr_ops nft_symhash_ops = { | |
| 197 | + .type = &nft_hash_type, | |
| 198 | + .size = NFT_EXPR_SIZE(sizeof(struct nft_symhash)), | |
| 199 | + .eval = nft_symhash_eval, | |
| 200 | + .init = nft_symhash_init, | |
| 201 | + .dump = nft_symhash_dump, | |
| 202 | +}; | |
| 203 | + | |
| 204 | +static const struct nft_expr_ops * | |
| 205 | +nft_hash_select_ops(const struct nft_ctx *ctx, | |
| 206 | + const struct nlattr * const tb[]) | |
| 207 | +{ | |
| 208 | + u32 type; | |
| 209 | + | |
| 210 | + if (!tb[NFTA_HASH_TYPE]) | |
| 211 | + return &nft_jhash_ops; | |
| 212 | + | |
| 213 | + type = ntohl(nla_get_be32(tb[NFTA_HASH_TYPE])); | |
| 214 | + switch (type) { | |
| 215 | + case NFT_HASH_SYM: | |
| 216 | + return &nft_symhash_ops; | |
| 217 | + case NFT_HASH_JENKINS: | |
| 218 | + return &nft_jhash_ops; | |
| 219 | + default: | |
| 220 | + break; | |
| 221 | + } | |
| 222 | + return ERR_PTR(-EOPNOTSUPP); | |
| 223 | +} | |
| 224 | + | |
| 128 | 225 | static struct nft_expr_type nft_hash_type __read_mostly = { |
| 129 | 226 | .name = "hash", |
| 130 | − .ops = &nft_jhash_ops, | |
| 227 | + .select_ops = &nft_hash_select_ops, | |
| 131 | 228 | .policy = nft_hash_policy, |
| 132 | 229 | .maxattr = NFTA_HASH_MAX, |
| 133 | 230 | .owner = THIS_MODULE, |