Re: load balancing between two chains

[Florian Westphal <fw@strlen.de>]

Florian Westphal <fw@strlen.de> wrote:
> sbezverk <sbezverk@gmail.com> wrote:
> > Numgen has GOTO directive and not Jump (Phil asked to change it), I thought it means after hitting any chains in numgen the processing will go back to service chain, no?
> > 
> > It is Ubuntu 18.04
> > 
> > sbezverk@kube-4:~$ uname -a
> > Linux kube-4 5.4.10-050410-generic #202001091038 SMP Thu Jan 9 10:41:11 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
> > sbezverk@kube-4:~$ sudo nft --version
> > nftables v0.9.1 (Headless Horseman)
> > sbezverk@kube-4:~$
> > 
> > I also want to remind you that I do NOT use nft cli to program rules, I use nft cli just to see resulting rules.
> 
> In that case, please include "nft --debug=netlink list ruleset".
> 
> It would also be good to check if things work when you add it via nft
> tool.

Oh, and for the fun of it, you could also try this:

chain k8s-nfproxy-svc-M53CN2XYVUHRQ7UB {
	numgen inc mod 2 vmap { 0 : goto k8s-nfproxy-sep-I7XZOUOVPIQW4IXA, 1 : goto k8s-nfproxy-sep-ZNSGEJWUBCC5QYMQ, 16777216 : goto endianbug }
	counter packets 0 bytes 0 } 
        chain endianbug {
		 counter packets 0 bytes 0
	}
 ...

numgen generates a 32bit number in host byte order, so nft internally
converts the keys accordingly (16777216 is htonl(1)).