| Message ID | 20180423104807.eavendvks2ky4adk@nevthink |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [nf-next] netfilter: nf_tables: enable hashing of one element | expand |
On Mon, Apr 23, 2018 at 12:48:07PM +0200, Laura Garcia Liebana wrote: > The modulus in the hash function was limited to > 1 as initially > there was no sense to create a hashing of just one element. > > Nevertheless, there are certain cases specially for load balancing > where this case needs to be addressed. > > This patch fixes the following error. > > Error: Could not process rule: Numerical result out of range > add rule ip nftlb lb01 dnat to jhash ip saddr mod 1 map { 0: 192.168.0.10 } > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > The solution comes to force the hash to 0 when the modulus is 1. Applied, but see comment below. > Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> > --- > net/netfilter/nft_hash.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c > index 24f2f7567ddb..1c4f791552d0 100644 > --- a/net/netfilter/nft_hash.c > +++ b/net/netfilter/nft_hash.c > @@ -53,7 +53,11 @@ static void nft_symhash_eval(const struct nft_expr *expr, > struct sk_buff *skb = pkt->skb; > u32 h; > > - h = reciprocal_scale(__skb_get_hash_symmetric(skb), priv->modulus); > + if (priv->modulus) > + h = reciprocal_scale(__skb_get_hash_symmetric(skb), > + priv->modulus); > + else > + h = 0; I have left this chunk behind, this looks like an early optimization to me. For the case where we only have one single element in the map, reciprocal_scale will return zero for this, so no need for the extra branch. > regs->data[priv->dreg] = h + priv->offset; > } > @@ -97,7 +101,7 @@ static int nft_jhash_init(const struct nft_ctx *ctx, > priv->len = len; > > priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS])); > - if (priv->modulus <= 1) > + if (priv->modulus < 1) > return -ERANGE; > > if (priv->offset + priv->modulus - 1 < priv->offset) > -- > 2.11.0 > > -- > To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c index 24f2f7567ddb..1c4f791552d0 100644 --- a/net/netfilter/nft_hash.c +++ b/net/netfilter/nft_hash.c @@ -53,7 +53,11 @@ static void nft_symhash_eval(const struct nft_expr *expr, struct sk_buff *skb = pkt->skb; u32 h; - h = reciprocal_scale(__skb_get_hash_symmetric(skb), priv->modulus); + if (priv->modulus) + h = reciprocal_scale(__skb_get_hash_symmetric(skb), + priv->modulus); + else + h = 0; regs->data[priv->dreg] = h + priv->offset; } @@ -97,7 +101,7 @@ static int nft_jhash_init(const struct nft_ctx *ctx, priv->len = len; priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS])); - if (priv->modulus <= 1) + if (priv->modulus < 1) return -ERANGE; if (priv->offset + priv->modulus - 1 < priv->offset)
The modulus in the hash function was limited to > 1 as initially there was no sense to create a hashing of just one element. Nevertheless, there are certain cases specially for load balancing where this case needs to be addressed. This patch fixes the following error. Error: Could not process rule: Numerical result out of range add rule ip nftlb lb01 dnat to jhash ip saddr mod 1 map { 0: 192.168.0.10 } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The solution comes to force the hash to 0 when the modulus is 1. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> --- net/netfilter/nft_hash.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)