From 3a86406729782ee2671ec7161c76529c2e4a44e4 Mon Sep 17 00:00:00 2001 From: Laura Garcia Liebana Date: Tue, 28 Feb 2017 18:42:50 +0100 Subject: src: hash: support of symmetric hash This patch provides symmetric hash support according to source ip address and port, and destination ip address and port. The new attribute NFTA_HASH_TYPE has been included to support different types of hashing functions. Currently supported NFT_HASH_JENKINS through jhash and NFT_HASH_SYM through symhash. The main difference between both types are: - jhash requires an expression with sreg, symhash doesn't. - symhash supports modulus and offset, but not seed. Examples: nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2 nft add rule ip nat prerouting ct mark set symhash mod 2 Signed-off-by: Laura Garcia Liebana Signed-off-by: Pablo Neira Ayuso --- include/expression.h | 1 + include/hash.h | 2 +- include/linux/netfilter/nf_tables.h | 13 +++++++++++++ 3 files changed, 15 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/expression.h b/include/expression.h index 83ecf111..4f2948cc 100644 --- a/include/expression.h +++ b/include/expression.h @@ -309,6 +309,7 @@ struct expr { uint32_t mod; uint32_t seed; uint32_t offset; + enum nft_hash_types type; } hash; struct { /* EXPR_FIB */ diff --git a/include/hash.h b/include/hash.h index 8bf53e2e..7f9c6f13 100644 --- a/include/hash.h +++ b/include/hash.h @@ -3,6 +3,6 @@ extern struct expr *hash_expr_alloc(const struct location *loc, uint32_t modulus, uint32_t seed, - uint32_t offset); + uint32_t offset, enum nft_hash_types type); #endif /* NFTABLES_HASH_H */ diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index 05215d30..4f7d7568 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -815,6 +815,17 @@ enum nft_rt_keys { NFT_RT_NEXTHOP6, }; +/** + * enum nft_hash_types - nf_tables hash expression types + * + * @NFT_HASH_JENKINS: Jenkins Hash + * @NFT_HASH_SYM: Symmetric Hash + */ +enum nft_hash_types { + NFT_HASH_JENKINS, + NFT_HASH_SYM, +}; + /** * enum nft_hash_attributes - nf_tables hash expression netlink attributes * @@ -824,6 +835,7 @@ enum nft_rt_keys { * @NFTA_HASH_MODULUS: modulus value (NLA_U32) * @NFTA_HASH_SEED: seed value (NLA_U32) * @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32) + * @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types) */ enum nft_hash_attributes { NFTA_HASH_UNSPEC, @@ -833,6 +845,7 @@ enum nft_hash_attributes { NFTA_HASH_MODULUS, NFTA_HASH_SEED, NFTA_HASH_OFFSET, + NFTA_HASH_TYPE, __NFTA_HASH_MAX, }; #define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1) -- cgit v1.2.3