Re: [PATCH 1/1] extensions: libxt_cluster: Add translation to nft

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, May 24, 2017 at 05:46:15PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Wed, May 24, 2017 at 06:01:51PM +0530, Shyam Saini wrote:
> > > Add translation for cluster to nft
> > 
> > I think this should be:
> > 
> >         -m cluster --cluster-total-nodes 2 --cluster-local-node 1 --cluster-hash-seed 0xdeadbeef
> > 
> > should be translated to:
> > 
> >         jhash ct original saddr mod 2 seed 0xdeadbeef eq 0
> > 
> > if --cluster-local-node is 2, then:
> > 
> >         jhash ct original saddr mod 2 seed 0xdeadbeef eq 1
> 
> Looks good.  But I think we need to take care of mangling pkttype as
> well, right?

We should if we want to 1:1 translation, yes.

Actually, if we rely on the nft arp mac address mangling (to use
multicast ethernet address, ie. RFC violation to cheat dummy switch
just in case you need this to get a packet flooded to two ports), we
could just do this upfront in the ruleset, ie.

        ether daddr 01:00:5e:00:01:01 meta set pkttype host

Using the mac address that we set to arp replies, instead of blind
mangling the mac address.

Anyway, yes, something like:

         jhash ct original saddr mod 2 seed 0xdeadbeef eq 0 meta pkttype set host

should be good enough.