History

netfilter: nft_hash: support of symmetric hash

This patch provides symmetric hash support according to source ip address and port, and destination ip address and port. For this purpose, the __skb_get_hash_symmetric() is used to identify the flow as it uses FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL flag by default. The new attribute NFTA_HASH_TYPE has been included to support different types of hashing functions. Currently supported NFT_HASH_JENKINS through jhash and NFT_HASH_SYM through symhash. The main difference between both types are: - jhash requires an expression with sreg, symhash doesn't. - symhash supports modulus and offset, but not seed. Examples: nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2 nft add rule ip nat prerouting ct mark set symhash mod 2 By default, jenkins hash will be used if no hash type is provided for compatibility reasons.

Laura Garcia Liebana committed 9 years ago

Commit 3206cad1 parent 511040e2 files · +111 −1Browse files

Showing the changes to include/uapi/linux (1 of 2 files). Show all

Unified · Split

include/uapi/linux/netfilter/nf_tables.h+13−0
@@ -815,6 +815,17 @@ enum nft_rt_keys { · 814 unmodified lines
815 NFT_RT_NEXTHOP6,815 NFT_RT_NEXTHOP6,
816};816};
817 817
818/**
819 * enum nft_hash_types - nf_tables hash expression types
820 *
821 * @NFT_HASH_JENKINS: Jenkins Hash
822 * @NFT_HASH_SYM: Symmetric Hash
823 */
824enum nft_hash_types {
825 NFT_HASH_JENKINS,
826 NFT_HASH_SYM,
827};
828
818/**829/**
819 * enum nft_hash_attributes - nf_tables hash expression netlink attributes830 * enum nft_hash_attributes - nf_tables hash expression netlink attributes
820 *831 *
@@ -824,6 +835,7 @@ enum nft_rt_keys { · 3 unmodified lines
824 * @NFTA_HASH_MODULUS: modulus value (NLA_U32)835 * @NFTA_HASH_MODULUS: modulus value (NLA_U32)
825 * @NFTA_HASH_SEED: seed value (NLA_U32)836 * @NFTA_HASH_SEED: seed value (NLA_U32)
826 * @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)837 * @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)
838 * @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types)
827 */839 */
828enum nft_hash_attributes {840enum nft_hash_attributes {
829 NFTA_HASH_UNSPEC,841 NFTA_HASH_UNSPEC,
@@ -833,6 +845,7 @@ enum nft_hash_attributes { · 3 unmodified lines
833 NFTA_HASH_MODULUS,845 NFTA_HASH_MODULUS,
834 NFTA_HASH_SEED,846 NFTA_HASH_SEED,
835 NFTA_HASH_OFFSET,847 NFTA_HASH_OFFSET,
848 NFTA_HASH_TYPE,
836 __NFTA_HASH_MAX,849 __NFTA_HASH_MAX,
837};850};
838#define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1)851#define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1)