From 13eeed6ea6f0a5d1353ee5ad14c4322695b4f59b Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 26 Aug 2016 14:41:41 +0200 Subject: src: add numgen expression This new expression allows us to generate incremental and random numbers bound to a specified modulus value. The following rule sets the conntrack mark of 0 to the first packet seen, then 1 to second packet, then 0 again to the third packet and so on: # nft add rule x y ct mark set numgen inc mod 2 A more useful example is a simple load balancing scenario, where you can also use maps to set the destination NAT address based on this new numgen expression: # nft add rule nat prerouting \ dnat to numgen inc mod 2 map { 0 : 192.168.10.100, 1 : 192.168.20.200 } So this is distributing new connections in a round-robin fashion between 192.168.10.100 and 192.168.20.200. Don't forget the special NAT chain semantics: Only the first packet evaluates the rule, follow up packets rely on conntrack to apply the NAT information. You can also emulate flow distribution with different backend weights using intervals: # nft add rule nat prerouting \ dnat to numgen inc mod 10 map { 0-5 : 192.168.10.100, 6-9 : 192.168.20.200 } So 192.168.10.100 gets 60% of the workload, while 192.168.20.200 gets 40%. We can also be mixed with dynamic sets, thus weight can be updated in runtime. Signed-off-by: Pablo Neira Ayuso --- src/evaluate.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'src/evaluate.c') diff --git a/src/evaluate.c b/src/evaluate.c index d669b85b..ed722df9 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1158,6 +1158,31 @@ static int expr_evaluate_mapping(struct eval_ctx *ctx, struct expr **expr) return 0; } +/* We got datatype context via statement. If the basetype is compatible, set + * this expression datatype to the one of the statement to make it datatype + * compatible. This is a more conservative approach than enabling datatype + * compatibility between two different datatypes whose basetype is the same, + * let's revisit this later once users come with valid usecases to generalize + * this. + */ +static void expr_dtype_integer_compatible(struct eval_ctx *ctx, + struct expr *expr) +{ + if (ctx->ectx.dtype && + ctx->ectx.dtype->basetype == &integer_type && + ctx->ectx.len == 4 * BITS_PER_BYTE) { + expr->dtype = ctx->ectx.dtype; + expr->len = ctx->ectx.len; + } +} + +static int expr_evaluate_numgen(struct eval_ctx *ctx, struct expr **exprp) +{ + expr_dtype_integer_compatible(ctx, *exprp); + + return expr_evaluate_primary(ctx, exprp); +} + /* * Transfer the invertible binops to the constant side of an equality * expression. A left shift is only invertible if the low n bits are @@ -1560,6 +1585,8 @@ static int expr_evaluate(struct eval_ctx *ctx, struct expr **expr) return expr_evaluate_mapping(ctx, expr); case EXPR_RELATIONAL: return expr_evaluate_relational(ctx, expr); + case EXPR_NUMGEN: + return expr_evaluate_numgen(ctx, expr); default: BUG("unknown expression type %s\n", (*expr)->ops->name); } -- cgit v1.2.3