History

netfilter: nft_hash: support of symmetric hash

This patch provides symmetric hash support according to source ip address and port, and destination ip address and port. For this purpose, the __skb_get_hash_symmetric() is used to identify the flow as it uses FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL flag by default. The new attribute NFTA_HASH_TYPE has been included to support different types of hashing functions. Currently supported NFT_HASH_JENKINS through jhash and NFT_HASH_SYM through symhash. The main difference between both types are: - jhash requires an expression with sreg, symhash doesn't. - symhash supports modulus and offset, but not seed. Examples: nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2 nft add rule ip nat prerouting ct mark set symhash mod 2 By default, jenkins hash will be used if no hash type is provided for compatibility reasons.

Laura Garcia Liebana committed 9 years ago

Commit 3206cad1 parent 511040e2 files · +111 −1Browse files

Showing the changes to include/uapi/linux (1 of 2 files). Show all

Unified · Split

include/uapi/linux/netfilter/nf_tables.h+13−0
@@ -815,6 +815,17 @@ enum nft_rt_keys { · 814 unmodified lines
815815 NFT_RT_NEXTHOP6,
816816 };
817817
818+/**
819+ * enum nft_hash_types - nf_tables hash expression types
820+ *
821+ * @NFT_HASH_JENKINS: Jenkins Hash
822+ * @NFT_HASH_SYM: Symmetric Hash
823+ */
824+enum nft_hash_types {
825+ NFT_HASH_JENKINS,
826+ NFT_HASH_SYM,
827+};
828+
818829 /**
819830 * enum nft_hash_attributes - nf_tables hash expression netlink attributes
820831 *
@@ -824,6 +835,7 @@ enum nft_rt_keys { · 3 unmodified lines
824835 * @NFTA_HASH_MODULUS: modulus value (NLA_U32)
825836 * @NFTA_HASH_SEED: seed value (NLA_U32)
826837 * @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)
838+ * @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types)
827839 */
828840 enum nft_hash_attributes {
829841 NFTA_HASH_UNSPEC,
@@ -833,6 +845,7 @@ enum nft_hash_attributes { · 3 unmodified lines
833845 NFTA_HASH_MODULUS,
834846 NFTA_HASH_SEED,
835847 NFTA_HASH_OFFSET,
848+ NFTA_HASH_TYPE,
836849 __NFTA_HASH_MAX,
837850 };
838851 #define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1)