path: root/src/netlink_linearize.c
diff options
authorPablo Neira Ayuso <>2016-08-26 14:41:41 +0200
committerPablo Neira Ayuso <>2016-08-29 20:30:28 +0200
commit13eeed6ea6f0a5d1353ee5ad14c4322695b4f59b (patch)
treedee935f0f40bb41399b8d5d0c8ab4f23e53fd7d3 /src/netlink_linearize.c
parent1ed9a3726c01fda218f37b7f4555c8b7106521ef (diff)
src: add numgen expression
This new expression allows us to generate incremental and random numbers bound to a specified modulus value. The following rule sets the conntrack mark of 0 to the first packet seen, then 1 to second packet, then 0 again to the third packet and so on: # nft add rule x y ct mark set numgen inc mod 2 A more useful example is a simple load balancing scenario, where you can also use maps to set the destination NAT address based on this new numgen expression: # nft add rule nat prerouting \ dnat to numgen inc mod 2 map { 0 :, 1 : } So this is distributing new connections in a round-robin fashion between and Don't forget the special NAT chain semantics: Only the first packet evaluates the rule, follow up packets rely on conntrack to apply the NAT information. You can also emulate flow distribution with different backend weights using intervals: # nft add rule nat prerouting \ dnat to numgen inc mod 10 map { 0-5 :, 6-9 : } So gets 60% of the workload, while gets 40%. We can also be mixed with dynamic sets, thus weight can be updated in runtime. Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'src/netlink_linearize.c')
1 files changed, 15 insertions, 0 deletions
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index a14d0ff9..2c6848c5 100644
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -151,6 +151,19 @@ static void netlink_gen_meta(struct netlink_linearize_ctx *ctx,
nftnl_rule_add_expr(ctx->nlr, nle);
+static void netlink_gen_numgen(struct netlink_linearize_ctx *ctx,
+ const struct expr *expr,
+ enum nft_registers dreg)
+ struct nftnl_expr *nle;
+ nle = alloc_nft_expr("numgen");
+ netlink_put_register(nle, NFTNL_EXPR_NG_DREG, dreg);
+ netlink_put_register(nle, NFTNL_EXPR_NG_TYPE, expr->numgen.type);
+ nftnl_expr_set_u32(nle, NFTNL_EXPR_NG_UNTIL, expr->numgen.mod);
+ nftnl_rule_add_expr(ctx->nlr, nle);
static void netlink_gen_ct(struct netlink_linearize_ctx *ctx,
const struct expr *expr,
enum nft_registers dreg)
@@ -614,6 +627,8 @@ static void netlink_gen_expr(struct netlink_linearize_ctx *ctx,
return netlink_gen_ct(ctx, expr, dreg);
return netlink_gen_expr(ctx, expr->key, dreg);
+ return netlink_gen_numgen(ctx, expr, dreg);
BUG("unknown expression type %s\n", expr->ops->name);