From 345236211715ffb7cc28f6ff0b26acb90181e738 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 26 Aug 2016 18:00:00 +0200 Subject: src: add hash expression This is special expression that transforms an input expression into a 32-bit unsigned integer. This expression takes a modulus parameter to scale the result and the random seed so the hash result becomes harder to predict. You can use it to set the packet mark, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 seed 0xdeadbeef You can combine this with maps too, eg. # nft add rule x y dnat to jhash ip saddr mod 2 seed 0xdeadbeef map { \ 0 : 192.168.20.100, \ 1 : 192.168.30.100 \ } Currently, this expression implements the jenkins hash implementation available in the Linux kernel: http://lxr.free-electrons.com/source/include/linux/jhash.h But it should be possible to extend it to support any other hash function type. Signed-off-by: Pablo Neira Ayuso --- include/hash.h | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 include/hash.h (limited to 'include/hash.h') diff --git a/include/hash.h b/include/hash.h new file mode 100644 index 00000000..bc8c86af --- /dev/null +++ b/include/hash.h @@ -0,0 +1,7 @@ +#ifndef NFTABLES_HASH_H +#define NFTABLES_HASH_H + +extern struct expr *hash_expr_alloc(const struct location *loc, + uint32_t modulus, uint32_t seed); + +#endif /* NFTABLES_HASH_H */ -- cgit v1.2.3