diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-08-26 14:41:41 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-08-29 20:30:28 +0200 |
commit | 13eeed6ea6f0a5d1353ee5ad14c4322695b4f59b (patch) | |
tree | dee935f0f40bb41399b8d5d0c8ab4f23e53fd7d3 /src/numgen.c | |
parent | 1ed9a3726c01fda218f37b7f4555c8b7106521ef (diff) |
src: add numgen expression
This new expression allows us to generate incremental and random numbers
bound to a specified modulus value.
The following rule sets the conntrack mark of 0 to the first packet seen,
then 1 to second packet, then 0 again to the third packet and so on:
# nft add rule x y ct mark set numgen inc mod 2
A more useful example is a simple load balancing scenario, where you can
also use maps to set the destination NAT address based on this new numgen
expression:
# nft add rule nat prerouting \
dnat to numgen inc mod 2 map { 0 : 192.168.10.100, 1 : 192.168.20.200 }
So this is distributing new connections in a round-robin fashion between
192.168.10.100 and 192.168.20.200. Don't forget the special NAT chain
semantics: Only the first packet evaluates the rule, follow up packets
rely on conntrack to apply the NAT information.
You can also emulate flow distribution with different backend weights
using intervals:
# nft add rule nat prerouting \
dnat to numgen inc mod 10 map { 0-5 : 192.168.10.100, 6-9 : 192.168.20.200 }
So 192.168.10.100 gets 60% of the workload, while 192.168.20.200 gets 40%.
We can also be mixed with dynamic sets, thus weight can be updated in
runtime.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/numgen.c')
-rw-r--r-- | src/numgen.c | 68 |
1 files changed, 68 insertions, 0 deletions
diff --git a/src/numgen.c b/src/numgen.c new file mode 100644 index 00000000..d9a43aa0 --- /dev/null +++ b/src/numgen.c @@ -0,0 +1,68 @@ +/* + * Number generator expression definitions. + * + * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#include <nftables.h> +#include <expression.h> +#include <datatype.h> +#include <gmputil.h> +#include <numgen.h> +#include <utils.h> + +static const char *numgen_type[NFT_NG_RANDOM + 1] = { + [NFT_NG_INCREMENTAL] = "inc", + [NFT_NG_RANDOM] = "random", +}; + +static const char *numgen_type_str(enum nft_ng_types type) +{ + if (type > NFT_NG_RANDOM) + return "[unknown numgen]"; + + return numgen_type[type]; +} + +static void numgen_expr_print(const struct expr *expr) +{ + printf("numgen %s mod %u", numgen_type_str(expr->numgen.type), + expr->numgen.mod); +} + +static bool numgen_expr_cmp(const struct expr *e1, const struct expr *e2) +{ + return e1->numgen.type == e2->numgen.type && + e1->numgen.mod == e2->numgen.mod; +} + +static void numgen_expr_clone(struct expr *new, const struct expr *expr) +{ + new->numgen.type = expr->numgen.type; + new->numgen.mod = expr->numgen.mod; +} + +static const struct expr_ops numgen_expr_ops = { + .type = EXPR_NUMGEN, + .name = "numgen", + .print = numgen_expr_print, + .cmp = numgen_expr_cmp, + .clone = numgen_expr_clone, +}; + +struct expr *numgen_expr_alloc(const struct location *loc, + enum nft_ng_types type, uint32_t mod) +{ + struct expr *expr; + + expr = expr_alloc(loc, &numgen_expr_ops, &integer_type, + BYTEORDER_HOST_ENDIAN, 4 * BITS_PER_BYTE); + expr->numgen.type = type; + expr->numgen.mod = mod; + + return expr; +} |