diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-08-26 14:41:41 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-08-29 20:30:28 +0200 |
commit | 13eeed6ea6f0a5d1353ee5ad14c4322695b4f59b (patch) | |
tree | dee935f0f40bb41399b8d5d0c8ab4f23e53fd7d3 /src/netlink_linearize.c | |
parent | 1ed9a3726c01fda218f37b7f4555c8b7106521ef (diff) |
src: add numgen expression
This new expression allows us to generate incremental and random numbers
bound to a specified modulus value.
The following rule sets the conntrack mark of 0 to the first packet seen,
then 1 to second packet, then 0 again to the third packet and so on:
# nft add rule x y ct mark set numgen inc mod 2
A more useful example is a simple load balancing scenario, where you can
also use maps to set the destination NAT address based on this new numgen
expression:
# nft add rule nat prerouting \
dnat to numgen inc mod 2 map { 0 : 192.168.10.100, 1 : 192.168.20.200 }
So this is distributing new connections in a round-robin fashion between
192.168.10.100 and 192.168.20.200. Don't forget the special NAT chain
semantics: Only the first packet evaluates the rule, follow up packets
rely on conntrack to apply the NAT information.
You can also emulate flow distribution with different backend weights
using intervals:
# nft add rule nat prerouting \
dnat to numgen inc mod 10 map { 0-5 : 192.168.10.100, 6-9 : 192.168.20.200 }
So 192.168.10.100 gets 60% of the workload, while 192.168.20.200 gets 40%.
We can also be mixed with dynamic sets, thus weight can be updated in
runtime.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/netlink_linearize.c')
-rw-r--r-- | src/netlink_linearize.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index a14d0ff9..2c6848c5 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -151,6 +151,19 @@ static void netlink_gen_meta(struct netlink_linearize_ctx *ctx, nftnl_rule_add_expr(ctx->nlr, nle); } +static void netlink_gen_numgen(struct netlink_linearize_ctx *ctx, + const struct expr *expr, + enum nft_registers dreg) +{ + struct nftnl_expr *nle; + + nle = alloc_nft_expr("numgen"); + netlink_put_register(nle, NFTNL_EXPR_NG_DREG, dreg); + netlink_put_register(nle, NFTNL_EXPR_NG_TYPE, expr->numgen.type); + nftnl_expr_set_u32(nle, NFTNL_EXPR_NG_UNTIL, expr->numgen.mod); + nftnl_rule_add_expr(ctx->nlr, nle); +} + static void netlink_gen_ct(struct netlink_linearize_ctx *ctx, const struct expr *expr, enum nft_registers dreg) @@ -614,6 +627,8 @@ static void netlink_gen_expr(struct netlink_linearize_ctx *ctx, return netlink_gen_ct(ctx, expr, dreg); case EXPR_SET_ELEM: return netlink_gen_expr(ctx, expr->key, dreg); + case EXPR_NUMGEN: + return netlink_gen_numgen(ctx, expr, dreg); default: BUG("unknown expression type %s\n", expr->ops->name); } |