netfilter: nft_hash: generate Jenkins Hash per source register
Subsystems (2)
PATCH 1/1 netfilter: nft_hash: generate Jenkins Hash per source register
This patch adds a new hash expression, this provides jhash support but this can be extended to support for other hash functions.
The modulus and seed comes already come embedded into this new expression.
Use case example:
meta mark set hash ip saddr mod 10
--- include/uapi/linux/netfilter/nf_tables.h | 20 +++++ net/netfilter/Kconfig | 6 ++ net/netfilter/Makefile | 1 + net/netfilter/nft_hash.c | 134 +++++++++++++++++++++++++++++++ 4 files changed, 161 insertions(+) create mode 100644 net/netfilter/nft_hash.c
include/uapi/linux/netfilter/nf_tables.h +20 -0
@@ -1097,4 +1097,24 @@ enum nft_nth_attributes { };#define NFTA_NTH_MAX (__NFTA_NTH_MAX - 1) +/** +* enum nft_hash_attributes - nf_tables hash expression netlink attributes +* @NFTA_HASH_UNSPEC: unspecified attribute +* @NFTA_HASH_SREG: source register (NLA_U32) +* @NFTA_HASH_DREG: destination register (NLA_U32) +* @NFTA_HASH_LEN: source data length (NLA_U32) +* @NFTA_HASH_MODULUS: modulus value (NLA_U32) +* @NFTA_HASH_SEED: seed value (NLA_U32) +*/ +enum nft_hash_attributes { +NFTA_HASH_UNSPEC , +NFTA_HASH_SREG , +NFTA_HASH_DREG , +NFTA_HASH_LEN , +NFTA_HASH_MODULUS , +NFTA_HASH_SEED , + __NFTA_HASH_MAX, +}; +#define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1) +#endif /* _LINUX_NF_TABLES_H */
net/netfilter/Kconfig +6 -0
@@ -480,6 +480,12 @@ config NFT_NTH This option adds the "nth" expression that you can use to match a packet every a specific given value. +config NFT_HASH + tristate "Netfilter nf_tables hash module" + help + This option adds the "hash" expression that you can use to perform + a hash operation on registers. + config NFT_CT depends on NF_CONNTRACK tristate "Netfilter nf_tables conntrack module"
net/netfilter/Makefile +1 -0
@@ -81,6 +81,7 @@ obj-$(CONFIG_NFT_COMPAT) += nft_compat.o obj-$(CONFIG_NFT_EXTHDR) += nft_exthdr.o obj-$(CONFIG_NFT_META) += nft_meta.o obj-$(CONFIG_NFT_NTH) += nft_nth.o +obj-$(CONFIG_NFT_HASH) += nft_hash.o obj-$(CONFIG_NFT_CT) += nft_ct.o obj-$(CONFIG_NFT_LIMIT) += nft_limit.o obj-$(CONFIG_NFT_NAT) += nft_nat.o
net/netfilter/nft_hash.c new file +134 -0
134 lines not on this page · raw message
Signature · 1 line
2.8.1
Pablo Neira Ayuso
maintainerI'd rename the patch title to:
netfilter: nf_tables: add hash expression
While it is true that we support jenkins initially, we can potentially extend this to support anything, so let's keep this patch title a bit more generic.
Quoted 23 lines · Laura Garcia Liebana
This patch adds a new hash expression, this provides jhash support but this can be extended to support for other hash functions.
The modulus and seed comes already come embedded into this new expression.
Use case example:
meta mark set hash ip saddr mod 10Signed-off-by Laura Garcia Liebana <[email protected]>--- include/uapi/linux/netfilter/nf_tables.h | 20 +++++ net/netfilter/Kconfig | 6 ++ net/netfilter/Makefile | 1 + net/netfilter/nft_hash.c | 134 +++++++++++++++++++++++++++++++ 4 files changed, 161 insertions(+) create mode 100644 net/netfilter/nft_hash.cinclude/uapi/linux/netfilter/nf_tables.h +0
-0
include/uapi/linux/netfilter/nf_tables.h enum nft_nth_attributes { · line 1102
Quoted 6 lines
include/uapi/linux/netfilter/nf_tables.h +3
-0@@ -1097,4 +1097,24 @@ enum nft_nth_attributes { };#define NFTA_NTH_MAX (__NFTA_NTH_MAX - 1) +/** +* enum nft_hash_attributes - nf_tables hash expression netlink attributes +* @NFTA_HASH_UNSPEC: unspecified attribute
We don't document the unspec attribute in other spots, so no need to include this.
Quoted 23 lines
include/uapi/linux/netfilter/nf_tables.h +17
-0+* @NFTA_HASH_SREG: source register (NLA_U32) +* @NFTA_HASH_DREG: destination register (NLA_U32) +* @NFTA_HASH_LEN: source data length (NLA_U32) +* @NFTA_HASH_MODULUS: modulus value (NLA_U32) +* @NFTA_HASH_SEED: seed value (NLA_U32) +*/ +enum nft_hash_attributes { +NFTA_HASH_UNSPEC , +NFTA_HASH_SREG , +NFTA_HASH_DREG , +NFTA_HASH_LEN , +NFTA_HASH_MODULUS , +NFTA_HASH_SEED , + __NFTA_HASH_MAX, +}; +#define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1) +#endif /* _LINUX_NF_TABLES_H */ net/netfilter/Kconfig +0
-0
net/netfilter/Kconfig config NFT_NTH · line 481
Quoted 2 lines
net/netfilter/Kconfig +0
-0@@ -480,6 +480,12 @@ config NFT_NTH This option adds the "nth" expression that you can use to match a packet every a specific given value.
This seems to apply on top of your previous nth patch so it will not apply in my tree because of this dependency, better place this description in Kconfig in alphabetical order in Kconfig.
Quoted 36 lines
net/netfilter/Kconfig +6
-0+config NFT_HASH + tristate "Netfilter nf_tables hash module" + help + This option adds the "hash" expression that you can use to perform + a hash operation on registers. + config NFT_CT depends on NF_CONNTRACK tristate "Netfilter nf_tables conntrack module"net/netfilter/Makefile +1
-0@@ -81,6 +81,7 @@ obj-$(CONFIG_NFT_COMPAT) += nft_compat.o obj-$(CONFIG_NFT_EXTHDR) += nft_exthdr.o obj-$(CONFIG_NFT_META) += nft_meta.o obj-$(CONFIG_NFT_NTH) += nft_nth.o +obj-$(CONFIG_NFT_HASH) += nft_hash.o obj-$(CONFIG_NFT_CT) += nft_ct.o obj-$(CONFIG_NFT_LIMIT) += nft_limit.o obj-$(CONFIG_NFT_NAT) += nft_nat.onet/netfilter/nft_hash.c new file +9
-0@@ -0,0 +1,134 @@ +/* +* Copyright (c) 2016 Laura Garcia <[email protected]> +* +* This program is free software; you can redistribute it and/or modify +* it under the terms of the GNU General Public License version 2 as +* published by the Free Software Foundation. +* +*/ +
net/netfilter/nft_hash.c line 19
Quoted 10 lines
net/netfilter/nft_hash.c new file +10
-0+#include <linux/kernel.h> +#include <linux/init.h> +#include <linux/module.h> +#include <linux/netlink.h> +#include <linux/netfilter.h> +#include <linux/netfilter/nf_tables.h> +#include <linux/in.h> +#include <linux/ip.h> +#include <linux/ipv6.h> +#include <linux/static_key.h>
I think we don't need these include files above, probably you got them there from your copy and paste ;-)
net/netfilter/nft_hash.c line 27
Quoted 8 lines
net/netfilter/nft_hash.c new file +8
-0+#include <net/netfilter/nf_tables.h> +#include <net/netfilter/nf_tables_core.h> +#include <linux/jhash.h> + +struct nft_hash { +enum nft_registers sreg:8 ; +enum nft_registers dreg:8 ; +u32 len:8 ;
Better:
u8 len;
Quoted 20 lines
net/netfilter/nft_hash.c new file +20
-0+u32 modulus; +u32 seed; +}; + +static void nft_hash_eval (const struct nft_expr *expr, +struct nft_regs *regs, +const struct nft_pktinfo *pkt) +{ +struct nft_hash *priv =nft_expr_priv (expr); +const void *data = ®s->data[priv->sreg]; +u32 h; + + h =reciprocal_scale (jhash (data, priv->len, priv->seed), priv->modulus); + + regs->data[priv->dreg] = h; +} + +const struct nla_policy nft_hash_policy[NFTA_HASH_MAX +1 ] = { + [NFTA_HASH_SREG ] = { .type =NLA_U32 }, + [NFTA_HASH_DREG ] = { .type =NLA_U32 },
net/netfilter/nft_hash.c line 57
Quoted 10 lines
net/netfilter/nft_hash.c new file +10
-0+ [NFTA_HASH_LEN] = { .type = NLA_U32 }, + [NFTA_HASH_MODULUS] = { .type = NLA_U32 }, + [NFTA_HASH_SEED] = { .type = NLA_U32 }, +}; + +static int nft_hash_init (const struct nft_ctx *ctx, +const struct nft_expr *expr, +const struct nlattr *const tb[]) +{ +struct nft_hash *priv =nft_expr_priv (expr);
u32 len;
net/netfilter/nft_hash.c line 67
Quoted 10 lines
net/netfilter/nft_hash.c new file +10
-0+ +if (!tb[NFTA_HASH_SREG ] || + !tb[NFTA_HASH_DREG ] || + !tb[NFTA_HASH_LEN ]) +return -EINVAL ; + + priv->sreg =nft_parse_register (tb[NFTA_HASH_SREG ]); + priv->dreg =nft_parse_register (tb[NFTA_HASH_DREG ]); + + priv->len =ntohl (nla_get_be32 (tb[NFTA_HASH_LEN ]));
len = ntohl(nla_get_be32(tb[NFTA_HASH_LEN]));
if (len == 0 || len > U8_MAX)
return -EINVAL;Just to make sure we don't go over the u8 size. I remember we have this bug in nft_exthdr.c btw, so it would be to add something similar there too, in case you want to follow up with a patch to address that thing.