From 13eeed6ea6f0a5d1353ee5ad14c4322695b4f59b Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 26 Aug 2016 14:41:41 +0200 Subject: src: add numgen expression This new expression allows us to generate incremental and random numbers bound to a specified modulus value. The following rule sets the conntrack mark of 0 to the first packet seen, then 1 to second packet, then 0 again to the third packet and so on: # nft add rule x y ct mark set numgen inc mod 2 A more useful example is a simple load balancing scenario, where you can also use maps to set the destination NAT address based on this new numgen expression: # nft add rule nat prerouting \ dnat to numgen inc mod 2 map { 0 : 192.168.10.100, 1 : 192.168.20.200 } So this is distributing new connections in a round-robin fashion between 192.168.10.100 and 192.168.20.200. Don't forget the special NAT chain semantics: Only the first packet evaluates the rule, follow up packets rely on conntrack to apply the NAT information. You can also emulate flow distribution with different backend weights using intervals: # nft add rule nat prerouting \ dnat to numgen inc mod 10 map { 0-5 : 192.168.10.100, 6-9 : 192.168.20.200 } So 192.168.10.100 gets 60% of the workload, while 192.168.20.200 gets 40%. We can also be mixed with dynamic sets, thus weight can be updated in runtime. Signed-off-by: Pablo Neira Ayuso --- src/parser_bison.y | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) (limited to 'src/parser_bison.y') diff --git a/src/parser_bison.y b/src/parser_bison.y index 6b58fe77..23e8b275 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -407,6 +407,10 @@ static void location_update(struct location *loc, struct location *rhs, int n) %token DUP "dup" %token FWD "fwd" +%token NUMGEN "numgen" +%token INC "inc" +%token MOD "mod" + %token POSITION "position" %token COMMENT "comment" @@ -552,8 +556,8 @@ static void location_update(struct location *loc, struct location *rhs, int n) %type arp_hdr_expr %destructor { expr_free($$); } arp_hdr_expr %type arp_hdr_field -%type ip_hdr_expr icmp_hdr_expr -%destructor { expr_free($$); } ip_hdr_expr icmp_hdr_expr +%type ip_hdr_expr icmp_hdr_expr numgen_expr +%destructor { expr_free($$); } ip_hdr_expr icmp_hdr_expr numgen_expr %type ip_hdr_field icmp_hdr_field %type ip6_hdr_expr icmp6_hdr_expr %destructor { expr_free($$); } ip6_hdr_expr icmp6_hdr_expr @@ -582,7 +586,7 @@ static void location_update(struct location *loc, struct location *rhs, int n) %type meta_expr %destructor { expr_free($$); } meta_expr -%type meta_key meta_key_qualified meta_key_unqualified +%type meta_key meta_key_qualified meta_key_unqualified numgen_type %type ct_expr %destructor { expr_free($$); } ct_expr @@ -1967,6 +1971,7 @@ primary_expr : symbol_expr { $$ = $1; } | exthdr_expr { $$ = $1; } | meta_expr { $$ = $1; } | ct_expr { $$ = $1; } + | numgen_expr { $$ = $1; } | '(' basic_expr ')' { $$ = $2; } ; @@ -2454,6 +2459,16 @@ meta_stmt : META meta_key SET expr } ; +numgen_type : INC { $$ = NFT_NG_INCREMENTAL; } + | RANDOM { $$ = NFT_NG_RANDOM; } + ; + +numgen_expr : NUMGEN numgen_type MOD NUM + { + $$ = numgen_expr_alloc(&@$, $2, $4); + } + ; + ct_expr : CT ct_key { $$ = ct_expr_alloc(&@$, $2, -1); -- cgit v1.2.3