History

netfilter: nft_hash: support of symmetric hash

This patch provides symmetric hash support according to source ip address and port, and destination ip address and port. For this purpose, the __skb_get_hash_symmetric() is used to identify the flow as it uses FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL flag by default. The new attribute NFTA_HASH_TYPE has been included to support different types of hashing functions. Currently supported NFT_HASH_JENKINS through jhash and NFT_HASH_SYM through symhash. The main difference between both types are: - jhash requires an expression with sreg, symhash doesn't. - symhash supports modulus and offset, but not seed. Examples: nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2 nft add rule ip nat prerouting ct mark set symhash mod 2 By default, jenkins hash will be used if no hash type is provided for compatibility reasons.

Laura Garcia Liebana committed 9 years ago

Commit 3206cad1 parent 511040e2 files · +111 −1Browse files

Unified · Split

2 files
  1. include/uapi/linux/netfilter/nf_tables.h +13 −0
  2. net/netfilter/nft_hash.c +98 −1
include/uapi/linux/netfilter/nf_tables.h+13−0
@@ -815,6 +815,17 @@ enum nft_rt_keys { · 814 unmodified lines
815 NFT_RT_NEXTHOP6,815 NFT_RT_NEXTHOP6,
816};816};
817 817
818/**
819 * enum nft_hash_types - nf_tables hash expression types
820 *
821 * @NFT_HASH_JENKINS: Jenkins Hash
822 * @NFT_HASH_SYM: Symmetric Hash
823 */
824enum nft_hash_types {
825 NFT_HASH_JENKINS,
826 NFT_HASH_SYM,
827};
828
818/**829/**
819 * enum nft_hash_attributes - nf_tables hash expression netlink attributes830 * enum nft_hash_attributes - nf_tables hash expression netlink attributes
820 *831 *
@@ -824,6 +835,7 @@ enum nft_rt_keys { · 3 unmodified lines
824 * @NFTA_HASH_MODULUS: modulus value (NLA_U32)835 * @NFTA_HASH_MODULUS: modulus value (NLA_U32)
825 * @NFTA_HASH_SEED: seed value (NLA_U32)836 * @NFTA_HASH_SEED: seed value (NLA_U32)
826 * @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)837 * @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)
838 * @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types)
827 */839 */
828enum nft_hash_attributes {840enum nft_hash_attributes {
829 NFTA_HASH_UNSPEC,841 NFTA_HASH_UNSPEC,
@@ -833,6 +845,7 @@ enum nft_hash_attributes { · 3 unmodified lines
833 NFTA_HASH_MODULUS,845 NFTA_HASH_MODULUS,
834 NFTA_HASH_SEED,846 NFTA_HASH_SEED,
835 NFTA_HASH_OFFSET,847 NFTA_HASH_OFFSET,
848 NFTA_HASH_TYPE,
836 __NFTA_HASH_MAX,849 __NFTA_HASH_MAX,
837};850};
838#define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1)851#define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1)
net/netfilter/nft_hash.c+98−1
@@ -38,6 +38,25 @@ static void nft_jhash_eval(const struct nft_expr *expr, · 37 unmodified lines
38 regs->data[priv->dreg] = h + priv->offset;38 regs->data[priv->dreg] = h + priv->offset;
39}39}
40 40
41struct nft_symhash {
42 enum nft_registers dreg:8;
43 u32 modulus;
44 u32 offset;
45};
46
47static void nft_symhash_eval(const struct nft_expr *expr,
48 struct nft_regs *regs,
49 const struct nft_pktinfo *pkt)
50{
51 struct nft_symhash *priv = nft_expr_priv(expr);
52 struct sk_buff *skb = pkt->skb;
53 u32 h;
54
55 h = reciprocal_scale(__skb_get_hash_symmetric(skb), priv->modulus);
56
57 regs->data[priv->dreg] = h + priv->offset;
58}
59
41static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {60static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = {
42 [NFTA_HASH_SREG] = { .type = NLA_U32 },61 [NFTA_HASH_SREG] = { .type = NLA_U32 },
43 [NFTA_HASH_DREG] = { .type = NLA_U32 },62 [NFTA_HASH_DREG] = { .type = NLA_U32 },
@@ -45,6 +64,7 @@ static const struct nla_policy nft_hash_policy[NFTA_HASH_MAX + 1] = { · 1 unmodified line
45 [NFTA_HASH_MODULUS] = { .type = NLA_U32 },64 [NFTA_HASH_MODULUS] = { .type = NLA_U32 },
46 [NFTA_HASH_SEED] = { .type = NLA_U32 },65 [NFTA_HASH_SEED] = { .type = NLA_U32 },
47 [NFTA_HASH_OFFSET] = { .type = NLA_U32 },66 [NFTA_HASH_OFFSET] = { .type = NLA_U32 },
67 [NFTA_HASH_TYPE] = { .type = NLA_U32 },
48};68};
49 69
50static int nft_jhash_init(const struct nft_ctx *ctx,70static int nft_jhash_init(const struct nft_ctx *ctx,
@@ -92,6 +112,32 @@ static int nft_jhash_init(const struct nft_ctx *ctx, · 41 unmodified lines
92 NFT_DATA_VALUE, sizeof(u32));112 NFT_DATA_VALUE, sizeof(u32));
93}113}
94 114
115static int nft_symhash_init(const struct nft_ctx *ctx,
116 const struct nft_expr *expr,
117 const struct nlattr * const tb[])
118{
119 struct nft_symhash *priv = nft_expr_priv(expr);
120
121 if (!tb[NFTA_HASH_DREG] ||
122 !tb[NFTA_HASH_MODULUS])
123 return -EINVAL;
124
125 if (tb[NFTA_HASH_OFFSET])
126 priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET]));
127
128 priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);
129
130 priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
131 if (priv->modulus <= 1)
132 return -ERANGE;
133
134 if (priv->offset + priv->modulus - 1 < priv->offset)
135 return -EOVERFLOW;
136
137 return nft_validate_register_store(ctx, priv->dreg, NULL,
138 NFT_DATA_VALUE, sizeof(u32));
139}
140
95static int nft_jhash_dump(struct sk_buff *skb,141static int nft_jhash_dump(struct sk_buff *skb,
96 const struct nft_expr *expr)142 const struct nft_expr *expr)
97{143{
@@ -110,6 +156,28 @@ static int nft_jhash_dump(struct sk_buff *skb, · 12 unmodified lines
110 if (priv->offset != 0)156 if (priv->offset != 0)
111 if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset)))157 if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset)))
112 goto nla_put_failure;158 goto nla_put_failure;
159 if (nla_put_be32(skb, NFTA_HASH_TYPE, htonl(NFT_HASH_JENKINS)))
160 goto nla_put_failure;
161 return 0;
162
163nla_put_failure:
164 return -1;
165}
166
167static int nft_symhash_dump(struct sk_buff *skb,
168 const struct nft_expr *expr)
169{
170 const struct nft_symhash *priv = nft_expr_priv(expr);
171
172 if (nft_dump_register(skb, NFTA_HASH_DREG, priv->dreg))
173 goto nla_put_failure;
174 if (nla_put_be32(skb, NFTA_HASH_MODULUS, htonl(priv->modulus)))
175 goto nla_put_failure;
176 if (priv->offset != 0)
177 if (nla_put_be32(skb, NFTA_HASH_OFFSET, htonl(priv->offset)))
178 goto nla_put_failure;
179 if (nla_put_be32(skb, NFTA_HASH_TYPE, htonl(NFT_HASH_SYM)))
180 goto nla_put_failure;
113 return 0;181 return 0;
114 182
115nla_put_failure:183nla_put_failure:
@@ -125,9 +193,38 @@ static const struct nft_expr_ops nft_jhash_ops = { · 9 unmodified lines
125 .dump = nft_jhash_dump,193 .dump = nft_jhash_dump,
126};194};
127 195
196static const struct nft_expr_ops nft_symhash_ops = {
197 .type = &nft_hash_type,
198 .size = NFT_EXPR_SIZE(sizeof(struct nft_symhash)),
199 .eval = nft_symhash_eval,
200 .init = nft_symhash_init,
201 .dump = nft_symhash_dump,
202};
203
204static const struct nft_expr_ops *
205nft_hash_select_ops(const struct nft_ctx *ctx,
206 const struct nlattr * const tb[])
207{
208 u32 type;
209
210 if (!tb[NFTA_HASH_TYPE])
211 return &nft_jhash_ops;
212
213 type = ntohl(nla_get_be32(tb[NFTA_HASH_TYPE]));
214 switch (type) {
215 case NFT_HASH_SYM:
216 return &nft_symhash_ops;
217 case NFT_HASH_JENKINS:
218 return &nft_jhash_ops;
219 default:
220 break;
221 }
222 return ERR_PTR(-EOPNOTSUPP);
223}
224
128static struct nft_expr_type nft_hash_type __read_mostly = {225static struct nft_expr_type nft_hash_type __read_mostly = {
129 .name = "hash",226 .name = "hash",
130 .ops = &nft_jhash_ops,227 .select_ops = &nft_hash_select_ops,
131 .policy = nft_hash_policy,228 .policy = nft_hash_policy,
132 .maxattr = NFTA_HASH_MAX,229 .maxattr = NFTA_HASH_MAX,
133 .owner = THIS_MODULE,230 .owner = THIS_MODULE,