leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: nft_hash: support of symmetric hash

Browse Source 
This patch provides symmetric hash support according to source
ip address and port, and destination ip address and port.

For this purpose, the __skb_get_hash_symmetric() is used to
identify the flow as it uses FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL
flag by default.

The new attribute NFTA_HASH_TYPE has been included to support
different types of hashing functions. Currently supported
NFT_HASH_JENKINS through jhash and NFT_HASH_SYM through symhash.

The main difference between both types are:
 - jhash requires an expression with sreg, symhash doesn't.
 - symhash supports modulus and offset, but not seed.

Examples:

 nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2
 nft add rule ip nat prerouting ct mark set symhash mod 2

By default, jenkins hash will be used if no hash type is
provided for compatibility reasons.

Signed-off-by: Laura Garcia Liebana <laura.garcia@zevenet.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Laura Garcia Liebana
2017-03-02 17:00:14 +01:00
committed by Pablo Neira Ayuso
parent 511040eea2
commit 3206caded8
2 changed files with 111 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
include/uapi/linux/netfilter/nf_tables.h
View File

@@ -815,6 +815,17 @@ enum nft_rt_keys {
NFT_RT_NEXTHOP6,
};
/**
* enum nft_hash_types - nf_tables hash expression types
*
* @NFT_HASH_JENKINS: Jenkins Hash
* @NFT_HASH_SYM: Symmetric Hash
*/
enum nft_hash_types {
NFT_HASH_JENKINS,
NFT_HASH_SYM,
};
/**
* enum nft_hash_attributes - nf_tables hash expression netlink attributes
*
@@ -824,6 +835,7 @@ enum nft_rt_keys {
* @NFTA_HASH_MODULUS: modulus value (NLA_U32)
* @NFTA_HASH_SEED: seed value (NLA_U32)
* @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)
* @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types)
*/
enum nft_hash_attributes {
NFTA_HASH_UNSPEC,
@@ -833,6 +845,7 @@ enum nft_hash_attributes {
NFTA_HASH_MODULUS,
NFTA_HASH_SEED,
NFTA_HASH_OFFSET,
NFTA_HASH_TYPE,
__NFTA_HASH_MAX,
};
#define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1)