diff options
| author | Laura Garcia Liebana <nevola@gmail.com> | 2017-02-28 18:42:50 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-03-06 18:25:05 +0100 |
| commit | 3a86406729782ee2671ec7161c76529c2e4a44e4 (patch) | |
| tree | 931f8f89b8ab46e248830aaf4d99570d32beb6a6 /src/netlink_linearize.c | |
| parent | 24091fb6d084890ce167364ac78fed8ceb94ae85 (diff) | |
src: hash: support of symmetric hash
This patch provides symmetric hash support according to source
ip address and port, and destination ip address and port.
The new attribute NFTA_HASH_TYPE has been included to support
different types of hashing functions. Currently supported
NFT_HASH_JENKINS through jhash and NFT_HASH_SYM through symhash.
The main difference between both types are:
- jhash requires an expression with sreg, symhash doesn't.
- symhash supports modulus and offset, but not seed.
Examples:
nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2
nft add rule ip nat prerouting ct mark set symhash mod 2
Signed-off-by: Laura Garcia Liebana <laura.garcia@zevenet.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/netlink_linearize.c')
| -rw-r--r-- | src/netlink_linearize.c | 19 |
1 files changed, 12 insertions, 7 deletions
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index 48f34c25..293150e2 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -125,18 +125,23 @@ static void netlink_gen_hash(struct netlink_linearize_ctx *ctx, enum nft_registers sreg; struct nftnl_expr *nle; - sreg = get_register(ctx, expr->hash.expr); - netlink_gen_expr(ctx, expr->hash.expr, sreg); - release_register(ctx, expr->hash.expr); - nle = alloc_nft_expr("hash"); - netlink_put_register(nle, NFTNL_EXPR_HASH_SREG, sreg); + + if (expr->hash.expr) { + sreg = get_register(ctx, expr->hash.expr); + netlink_gen_expr(ctx, expr->hash.expr, sreg); + release_register(ctx, expr->hash.expr); + netlink_put_register(nle, NFTNL_EXPR_HASH_SREG, sreg); + + nftnl_expr_set_u32(nle, NFTNL_EXPR_HASH_LEN, + div_round_up(expr->hash.expr->len, + BITS_PER_BYTE)); + } netlink_put_register(nle, NFTNL_EXPR_HASH_DREG, dreg); - nftnl_expr_set_u32(nle, NFTNL_EXPR_HASH_LEN, - div_round_up(expr->hash.expr->len, BITS_PER_BYTE)); nftnl_expr_set_u32(nle, NFTNL_EXPR_HASH_MODULUS, expr->hash.mod); nftnl_expr_set_u32(nle, NFTNL_EXPR_HASH_SEED, expr->hash.seed); nftnl_expr_set_u32(nle, NFTNL_EXPR_HASH_OFFSET, expr->hash.offset); + nftnl_expr_set_u32(nle, NFTNL_EXPR_HASH_TYPE, expr->hash.type); nftnl_rule_add_expr(ctx->nlr, nle); } |