From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Hans Schillstrom <hans.schillstrom@ericsson.com>
Cc: kaber@trash.net, jengelh@medozas.de,
netfilter-devel@vger.kernel.org, netdev@vger.kernel.org,
hans@schillstrom.com
Subject: Re: [PATCH] NETFILTER module xt_hmark new target for HASH MARK
Date: Thu, 03 Feb 2011 14:51:18 +0100 [thread overview]
Message-ID: <4D4AB2D6.7070302@netfilter.org> (raw)
In-Reply-To: <1296740050-6311-2-git-send-email-hans.schillstrom@ericsson.com>
On 03/02/11 14:34, Hans Schillstrom wrote:
> +/*
> + * Calc hash value, special casre is taken on icmp and fragmented messages
> + * i.e. fragmented messages don't use ports.
> + */
> +static __u32 get_hash(struct sk_buff *skb, struct xt_hmark_info *info)
> +{
[...]
> + ip_proto &= info->prmask;
> + /* get a consistent hash (same value on both flow directions) */
> + if (addr2 < addr1)
> + swap(addr1, addr2);
this assumption is not valid in NAT handlings.
If you want consistent hashing with NAT handlings you'll have to make
this stateful and use the conntrack source and reply directions of the
original tuples (thus making it stateful). That may be a problem because
some people may want to use this without enabling connection tracking.
Are you using this for (uplink) load balancing?
Could you also include one realistic example in the patch description on
how this is used?
If this is accepted, I think this has to be merge with the (already
overloaded) MARK target.
next prev parent reply other threads:[~2011-02-03 13:51 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-02-03 13:34 [PATCH 0/2] NETFILTER new target module, HMARK Hans Schillstrom
2011-02-03 13:34 ` [PATCH] NETFILTER module xt_hmark new target for HASH MARK Hans Schillstrom
2011-02-03 13:51 ` Pablo Neira Ayuso [this message]
2011-02-03 14:23 ` Hans Schillstrom
2011-02-03 15:42 ` Pablo Neira Ayuso
2011-02-03 16:01 ` Pablo Neira Ayuso
2011-02-03 16:06 ` Jan Engelhardt
2011-02-03 16:08 ` Pablo Neira Ayuso
2011-02-03 16:32 ` Jan Engelhardt
2011-02-03 17:40 ` Hans Schillstrom
2011-02-03 17:37 ` Hans Schillstrom
2011-02-04 13:17 ` Patrick McHardy
2011-02-04 13:20 ` Patrick McHardy
2011-02-03 13:34 ` [PATCH] NETFILTER userspace part for target HMARK Hans Schillstrom
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4D4AB2D6.7070302@netfilter.org \
--to=pablo@netfilter.org \
--cc=hans.schillstrom@ericsson.com \
--cc=hans@schillstrom.com \
--cc=jengelh@medozas.de \
--cc=kaber@trash.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).