From 345236211715ffb7cc28f6ff0b26acb90181e738 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 26 Aug 2016 18:00:00 +0200 Subject: src: add hash expression This is special expression that transforms an input expression into a 32-bit unsigned integer. This expression takes a modulus parameter to scale the result and the random seed so the hash result becomes harder to predict. You can use it to set the packet mark, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 seed 0xdeadbeef You can combine this with maps too, eg. # nft add rule x y dnat to jhash ip saddr mod 2 seed 0xdeadbeef map { \ 0 : 192.168.20.100, \ 1 : 192.168.30.100 \ } Currently, this expression implements the jenkins hash implementation available in the Linux kernel: http://lxr.free-electrons.com/source/include/linux/jhash.h But it should be possible to extend it to support any other hash function type. Signed-off-by: Pablo Neira Ayuso --- include/expression.h | 9 +++++++++ include/hash.h | 7 +++++++ 2 files changed, 16 insertions(+) create mode 100644 include/hash.h (limited to 'include') diff --git a/include/expression.h b/include/expression.h index b6005ec3..6a509b33 100644 --- a/include/expression.h +++ b/include/expression.h @@ -34,6 +34,7 @@ * @EXPR_BINOP: binary operations (bitwise, shifts) * @EXPR_RELATIONAL: equality and relational expressions * @EXPR_NUMGEN: number generation expression + * @EXPR_HASH: hash expression */ enum expr_types { EXPR_INVALID, @@ -57,6 +58,7 @@ enum expr_types { EXPR_BINOP, EXPR_RELATIONAL, EXPR_NUMGEN, + EXPR_HASH, }; enum ops { @@ -174,6 +176,7 @@ enum expr_flags { #include #include #include +#include #include /** @@ -285,6 +288,12 @@ struct expr { enum nft_ng_types type; uint32_t mod; } numgen; + struct { + /* EXPR_HASH */ + struct expr *expr; + uint32_t mod; + uint32_t seed; + } hash; }; }; diff --git a/include/hash.h b/include/hash.h new file mode 100644 index 00000000..bc8c86af --- /dev/null +++ b/include/hash.h @@ -0,0 +1,7 @@ +#ifndef NFTABLES_HASH_H +#define NFTABLES_HASH_H + +extern struct expr *hash_expr_alloc(const struct location *loc, + uint32_t modulus, uint32_t seed); + +#endif /* NFTABLES_HASH_H */ -- cgit v1.2.3