summaryrefslogtreecommitdiffstats
path: root/tests/py/ip/numgen.t.payload
Commit message (Collapse)AuthorAgeFilesLines
* tests/py: Adjust payloads for fixed nat statement dumpsPhil Sutter2021-03-091-2/+2
| | | | | | Libnftnl no longer dumps unused regs, so drop those. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: fix incorrect bytecode in numgen and hash mappingsPablo Neira Ayuso2017-02-251-1/+1
| | | | | | | Byteorder is not correct as it is expressed in network byteorder. This uncovered when storing set byteorder in NFTA_USER_DATA. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: add missing payload test for numgen offsetPablo Neira Ayuso2016-10-311-0/+5
| | | | | | | | | | The new cover test for: ct mark set numgen inc mod 2 offset 100 was lacking the payload file chunk. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: fix numgen case failed due to changes in libnftnlLiping Zhang2016-09-231-3/+3
| | | | | | | | | | | | In nftnl_expr_ng_snprintf_default, format "(%u)" was changed to "mod %u", so numgen test case failed: ... '[ numgen reg 1 = inc(2) ]' mismatches '[ numgen reg 1 = inc mod 2 ]' ... ip/numgen.t: 3 unit tests, 3 error, 0 warning Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: adapt netlink bytecode output of numgen and hashPablo Neira Ayuso2016-08-301-3/+3
| | | | | | Adapt them to the revisited output string now in libnftnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add numgen expressionPablo Neira Ayuso2016-08-291-0/+24
This new expression allows us to generate incremental and random numbers bound to a specified modulus value. The following rule sets the conntrack mark of 0 to the first packet seen, then 1 to second packet, then 0 again to the third packet and so on: # nft add rule x y ct mark set numgen inc mod 2 A more useful example is a simple load balancing scenario, where you can also use maps to set the destination NAT address based on this new numgen expression: # nft add rule nat prerouting \ dnat to numgen inc mod 2 map { 0 : 192.168.10.100, 1 : 192.168.20.200 } So this is distributing new connections in a round-robin fashion between 192.168.10.100 and 192.168.20.200. Don't forget the special NAT chain semantics: Only the first packet evaluates the rule, follow up packets rely on conntrack to apply the NAT information. You can also emulate flow distribution with different backend weights using intervals: # nft add rule nat prerouting \ dnat to numgen inc mod 10 map { 0-5 : 192.168.10.100, 6-9 : 192.168.20.200 } So 192.168.10.100 gets 60% of the workload, while 192.168.20.200 gets 40%. We can also be mixed with dynamic sets, thus weight can be updated in runtime. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>