src: hash: support of symmetric hash

This patch provides symmetric hash support according to source
ip address and port, and destination ip address and port.

The new attribute NFTA_HASH_TYPE has been included to support
different types of hashing functions. Currently supported
NFT_HASH_JENKINS through jhash and NFT_HASH_SYM through symhash.

The main difference between both types are:
 - jhash requires an expression with sreg, symhash doesn't.
 - symhash supports modulus and offset, but not seed.

Examples:

 nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2
 nft add rule ip nat prerouting ct mark set symhash mod 2

Signed-off-by: Laura Garcia Liebana <laura.garcia@zevenet.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

6 files changed, 67 insertions, 35 deletions

diff --git a/src/evaluate.c b/src/evaluate.c
index 54985166..efcafc72 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1288,7 +1288,8 @@ static int expr_evaluate_hash(struct eval_ctx *ctx, struct expr **exprp)
 	expr_dtype_integer_compatible(ctx, expr);
 
 	expr_set_context(&ctx->ectx, NULL, 0);
-	if (expr_evaluate(ctx, &expr->hash.expr) < 0)
+	if (expr->hash.expr &&
+	    expr_evaluate(ctx, &expr->hash.expr) < 0)
 		return -1;
 
 	/* expr_evaluate_primary() sets the context to what to the input
diff --git a/src/hash.c b/src/hash.c
index d26b2eda..a7a96122 100644
--- a/src/hash.c
+++ b/src/hash.c
@@ -17,10 +17,18 @@
 
 static void hash_expr_print(const struct expr *expr)
 {
-	printf("jhash ");
-	expr_print(expr->hash.expr);
+	switch (expr->hash.type) {
+	case NFT_HASH_SYM:
+		printf("symhash");
+	break;
+	case NFT_HASH_JENKINS:
+	default:
+		printf("jhash ");
+		expr_print(expr->hash.expr);
+	}
+
 	printf(" mod %u", expr->hash.mod);
-	if (expr->hash.seed)
+	if (expr->hash.type & NFT_HASH_JENKINS && expr->hash.seed)
 		printf(" seed 0x%x", expr->hash.seed);
 	if (expr->hash.offset)
 		printf(" offset %u", expr->hash.offset);
@@ -28,18 +36,22 @@ static void hash_expr_print(const struct expr *expr)
 
 static bool hash_expr_cmp(const struct expr *e1, const struct expr *e2)
 {
-	return expr_cmp(e1->hash.expr, e2->hash.expr) &&
+	return (e1->hash.expr ||
+		expr_cmp(e1->hash.expr, e2->hash.expr)) &&
 	       e1->hash.mod == e2->hash.mod &&
 	       e1->hash.seed == e2->hash.seed &&
-	       e1->hash.offset == e2->hash.offset;
+	       e1->hash.offset == e2->hash.offset &&
+	       e1->hash.type == e2->hash.type;
 }
 
 static void hash_expr_clone(struct expr *new, const struct expr *expr)
 {
-	new->hash.expr = expr_clone(expr->hash.expr);
+	if (expr->hash.expr)
+		new->hash.expr = expr_clone(expr->hash.expr);
 	new->hash.mod = expr->hash.mod;
 	new->hash.seed = expr->hash.seed;
 	new->hash.offset = expr->hash.offset;
+	new->hash.type = expr->hash.type;
 }
 
 static const struct expr_ops hash_expr_ops = {
@@ -51,7 +63,8 @@ static const struct expr_ops hash_expr_ops = {
 };
 
 struct expr *hash_expr_alloc(const struct location *loc, uint32_t mod,
-			     uint32_t seed, uint32_t offset)
+			     uint32_t seed, uint32_t offset,
+			     enum nft_hash_types type)
 {
 	struct expr *expr;
 
@@ -60,6 +73,7 @@ struct expr *hash_expr_alloc(const struct location *loc, uint32_t mod,
 	expr->hash.mod  = mod;
 	expr->hash.seed = seed;
 	expr->hash.offset = offset;
+	expr->hash.type = type;
 
 	return expr;
 }
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 39347e01..36e8fe3c 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -523,27 +523,33 @@ static void netlink_parse_hash(struct netlink_parse_ctx *ctx,
 	enum nft_registers sreg, dreg;
 	struct expr *expr, *hexpr;
 	uint32_t mod, seed, len, offset;
+	enum nft_hash_types type;
 
-	sreg = netlink_parse_register(nle, NFTNL_EXPR_HASH_SREG);
-	hexpr = netlink_get_register(ctx, loc, sreg);
-	if (hexpr == NULL)
-		return netlink_error(ctx, loc,
-				     "hash statement has no expression");
-
+	type = nftnl_expr_get_u32(nle, NFTNL_EXPR_HASH_TYPE);
 	offset = nftnl_expr_get_u32(nle, NFTNL_EXPR_HASH_OFFSET);
 	seed = nftnl_expr_get_u32(nle, NFTNL_EXPR_HASH_SEED);
 	mod  = nftnl_expr_get_u32(nle, NFTNL_EXPR_HASH_MODULUS);
-	len = nftnl_expr_get_u32(nle, NFTNL_EXPR_HASH_LEN) * BITS_PER_BYTE;
 
-	if (hexpr->len < len) {
-		hexpr = netlink_parse_concat_expr(ctx, loc, sreg, len);
+	expr = hash_expr_alloc(loc, mod, seed, offset, type);
+
+	if (type != NFT_HASH_SYM) {
+		sreg = netlink_parse_register(nle, NFTNL_EXPR_HASH_SREG);
+		hexpr = netlink_get_register(ctx, loc, sreg);
+
 		if (hexpr == NULL)
-			return;
+			return
+			netlink_error(ctx, loc,
+				      "hash statement has no expression");
+		len = nftnl_expr_get_u32(nle,
+					 NFTNL_EXPR_HASH_LEN) * BITS_PER_BYTE;
+		if (hexpr->len < len) {
+			hexpr = netlink_parse_concat_expr(ctx, loc, sreg, len);
+			if (hexpr == NULL)
+				return;
+		}
+		expr->hash.expr = hexpr;
 	}
 
-	expr = hash_expr_alloc(loc, mod, seed, offset);
-	expr->hash.expr = hexpr;
-
 	dreg = netlink_parse_register(nle, NFTNL_EXPR_HASH_DREG);
 	netlink_set_register(ctx, dreg, expr);
 }
@@ -1826,7 +1832,8 @@ static void expr_postprocess(struct rule_pp_ctx *ctx, struct expr **exprp)
 	case EXPR_FIB:
 		break;
 	case EXPR_HASH:
-		expr_postprocess(ctx, &expr->hash.expr);
+		if (expr->hash.expr)
+			expr_postprocess(ctx, &expr->hash.expr);
 		break;
 	case EXPR_CT:
 		ct_expr_update_type(&ctx->pctx, expr);
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index 48f34c25..293150e2 100644
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -125,18 +125,23 @@ static void netlink_gen_hash(struct netlink_linearize_ctx *ctx,
 	enum nft_registers sreg;
 	struct nftnl_expr *nle;
 
-	sreg = get_register(ctx, expr->hash.expr);
-	netlink_gen_expr(ctx, expr->hash.expr, sreg);
-	release_register(ctx, expr->hash.expr);
-
 	nle = alloc_nft_expr("hash");
-	netlink_put_register(nle, NFTNL_EXPR_HASH_SREG, sreg);
+
+	if (expr->hash.expr) {
+		sreg = get_register(ctx, expr->hash.expr);
+		netlink_gen_expr(ctx, expr->hash.expr, sreg);
+		release_register(ctx, expr->hash.expr);
+		netlink_put_register(nle, NFTNL_EXPR_HASH_SREG, sreg);
+
+		nftnl_expr_set_u32(nle, NFTNL_EXPR_HASH_LEN,
+				   div_round_up(expr->hash.expr->len,
+						BITS_PER_BYTE));
+	}
 	netlink_put_register(nle, NFTNL_EXPR_HASH_DREG, dreg);
-	nftnl_expr_set_u32(nle, NFTNL_EXPR_HASH_LEN,
-			   div_round_up(expr->hash.expr->len, BITS_PER_BYTE));
 	nftnl_expr_set_u32(nle, NFTNL_EXPR_HASH_MODULUS, expr->hash.mod);
 	nftnl_expr_set_u32(nle, NFTNL_EXPR_HASH_SEED, expr->hash.seed);
 	nftnl_expr_set_u32(nle, NFTNL_EXPR_HASH_OFFSET, expr->hash.offset);
+	nftnl_expr_set_u32(nle, NFTNL_EXPR_HASH_TYPE, expr->hash.type);
 	nftnl_rule_add_expr(ctx->nlr, nle);
 }
 
diff --git a/src/parser_bison.y b/src/parser_bison.y
index 15931e96..dff8a5ab 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -437,6 +437,7 @@ static void location_update(struct location *loc, struct location *rhs, int n)
 %token OFFSET			"offset"
 
 %token JHASH			"jhash"
+%token SYMHASH			"symhash"
 %token SEED			"seed"
 
 %token POSITION			"position"
@@ -512,7 +513,7 @@ static void location_update(struct location *loc, struct location *rhs, int n)
 %destructor { stmt_free($$); }	reject_stmt reject_stmt_alloc
 %type <stmt>			nat_stmt nat_stmt_alloc masq_stmt masq_stmt_alloc redir_stmt redir_stmt_alloc
 %destructor { stmt_free($$); }	nat_stmt nat_stmt_alloc masq_stmt masq_stmt_alloc redir_stmt redir_stmt_alloc
-%type <val>			nf_nat_flags nf_nat_flag offset_opt
+%type <val>			nf_nat_flags nf_nat_flag offset_opt seed_opt
 %type <stmt>			queue_stmt queue_stmt_alloc
 %destructor { stmt_free($$); }	queue_stmt queue_stmt_alloc
 %type <val>			queue_stmt_flags queue_stmt_flag
@@ -2916,15 +2917,18 @@ numgen_expr		:	NUMGEN	numgen_type	MOD	NUM	offset_opt
 			}
 			;
 
-hash_expr		:	JHASH	expr	MOD	NUM	SEED	NUM	offset_opt
+seed_opt		:	/* empty */	{ $$ = 0; }
+			|	SEED	NUM	{ $$ = $2; }
+			;
+
+hash_expr		:	JHASH		expr	MOD	NUM	seed_opt	offset_opt
 			{
-				$$ = hash_expr_alloc(&@$, $4, $6, $7);
+				$$ = hash_expr_alloc(&@$, $4, $5, $6, NFT_HASH_JENKINS);
 				$$->hash.expr = $2;
 			}
-			|	JHASH	expr	MOD	NUM	offset_opt
+			|	SYMHASH		MOD	NUM	offset_opt
 			{
-				$$ = hash_expr_alloc(&@$, $4, 0, $5);
-				$$->hash.expr = $2;
+				$$ = hash_expr_alloc(&@$, $3, 0, $4, NFT_HASH_SYM);
 			}
 			;
 
diff --git a/src/scanner.l b/src/scanner.l
index b70e1a80..003f15eb 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -488,6 +488,7 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
 "offset"		{ return OFFSET; }
 
 "jhash"			{ return JHASH; }
+"symhash"		{ return SYMHASH; }
 "seed"			{ return SEED; }
 
 "dup"			{ return DUP; }