From 345236211715ffb7cc28f6ff0b26acb90181e738 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 26 Aug 2016 18:00:00 +0200 Subject: src: add hash expression This is special expression that transforms an input expression into a 32-bit unsigned integer. This expression takes a modulus parameter to scale the result and the random seed so the hash result becomes harder to predict. You can use it to set the packet mark, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 seed 0xdeadbeef You can combine this with maps too, eg. # nft add rule x y dnat to jhash ip saddr mod 2 seed 0xdeadbeef map { \ 0 : 192.168.20.100, \ 1 : 192.168.30.100 \ } Currently, this expression implements the jenkins hash implementation available in the Linux kernel: http://lxr.free-electrons.com/source/include/linux/jhash.h But it should be possible to extend it to support any other hash function type. Signed-off-by: Pablo Neira Ayuso --- src/scanner.l | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src/scanner.l') diff --git a/src/scanner.l b/src/scanner.l index cff375f3..8b5a383b 100644 --- a/src/scanner.l +++ b/src/scanner.l @@ -471,6 +471,9 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "inc" { return INC; } "mod" { return MOD; } +"jhash" { return JHASH; } +"seed" { return SEED; } + "dup" { return DUP; } "fwd" { return FWD; } -- cgit v1.2.3