[nf-next] netfilter: nf_tables: enable hashing of one element
diff mbox series

Message ID 20180423104807.eavendvks2ky4adk@nevthink
State Accepted
Delegated to: Pablo Neira
Headers show
Series
  • [nf-next] netfilter: nf_tables: enable hashing of one element
Related show

Commit Message

Laura Garcia Liebana April 23, 2018, 10:48 a.m. UTC
The modulus in the hash function was limited to > 1 as initially
there was no sense to create a hashing of just one element.

Nevertheless, there are certain cases specially for load balancing
where this case needs to be addressed.

This patch fixes the following error.

Error: Could not process rule: Numerical result out of range
add rule ip nftlb lb01 dnat to jhash ip saddr mod 1 map { 0: 192.168.0.10 }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The solution comes to force the hash to 0 when the modulus is 1.

Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
---
 net/netfilter/nft_hash.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Comments

Pablo Neira Ayuso May 6, 2018, 9:26 p.m. UTC | #1
On Mon, Apr 23, 2018 at 12:48:07PM +0200, Laura Garcia Liebana wrote:
> The modulus in the hash function was limited to > 1 as initially
> there was no sense to create a hashing of just one element.
> 
> Nevertheless, there are certain cases specially for load balancing
> where this case needs to be addressed.
> 
> This patch fixes the following error.
> 
> Error: Could not process rule: Numerical result out of range
> add rule ip nftlb lb01 dnat to jhash ip saddr mod 1 map { 0: 192.168.0.10 }
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> The solution comes to force the hash to 0 when the modulus is 1.

Applied, but see comment below.

> Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
> ---
>  net/netfilter/nft_hash.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
> index 24f2f7567ddb..1c4f791552d0 100644
> --- a/net/netfilter/nft_hash.c
> +++ b/net/netfilter/nft_hash.c
> @@ -53,7 +53,11 @@ static void nft_symhash_eval(const struct nft_expr *expr,
>  	struct sk_buff *skb = pkt->skb;
>  	u32 h;
>  
> -	h = reciprocal_scale(__skb_get_hash_symmetric(skb), priv->modulus);
> +	if (priv->modulus)
> +		h = reciprocal_scale(__skb_get_hash_symmetric(skb),
> +				     priv->modulus);
> +	else
> +		h = 0;

I have left this chunk behind, this looks like an early optimization
to me. For the case where we only have one single element in the map,
reciprocal_scale will return zero for this, so no need for the extra
branch.

>  	regs->data[priv->dreg] = h + priv->offset;
>  }
> @@ -97,7 +101,7 @@ static int nft_jhash_init(const struct nft_ctx *ctx,
>  	priv->len = len;
>  
>  	priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
> -	if (priv->modulus <= 1)
> +	if (priv->modulus < 1)
>  		return -ERANGE;
>  
>  	if (priv->offset + priv->modulus - 1 < priv->offset)
> -- 
> 2.11.0
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch
diff mbox series

diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index 24f2f7567ddb..1c4f791552d0 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -53,7 +53,11 @@  static void nft_symhash_eval(const struct nft_expr *expr,
 	struct sk_buff *skb = pkt->skb;
 	u32 h;
 
-	h = reciprocal_scale(__skb_get_hash_symmetric(skb), priv->modulus);
+	if (priv->modulus)
+		h = reciprocal_scale(__skb_get_hash_symmetric(skb),
+				     priv->modulus);
+	else
+		h = 0;
 
 	regs->data[priv->dreg] = h + priv->offset;
 }
@@ -97,7 +101,7 @@  static int nft_jhash_init(const struct nft_ctx *ctx,
 	priv->len = len;
 
 	priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS]));
-	if (priv->modulus <= 1)
+	if (priv->modulus < 1)
 		return -ERANGE;
 
 	if (priv->offset + priv->modulus - 1 < priv->offset)