From: Hans Schillstrom <hans.schillstrom@ericsson•com>
To: Pablo Neira Ayuso <pablo@netfilter•org>
Cc: "kaber@trash•net" <kaber@trash•net>,
"jengelh@medozas•de" <jengelh@medozas•de>,
"netfilter-devel@vger•kernel.org"
<netfilter-devel@vger•kernel.org>,
"netdev@vger•kernel.org" <netdev@vger•kernel.org>,
"hans@schillstrom•com" <hans@schillstrom•com>
Subject: Re: [PATCH] NETFILTER module xt_hmark new target for HASH MARK
Date: Thu, 3 Feb 2011 15:23:15 +0100 [thread overview]
Message-ID: <1296742995.6662.57.camel@seasc0214> (raw)
In-Reply-To: <4D4AB2D6.7070302@netfilter.org>
On Thu, 2011-02-03 at 14:51 +0100, Pablo Neira Ayuso wrote:
> On 03/02/11 14:34, Hans Schillstrom wrote:
> > +/*
> > + * Calc hash value, special casre is taken on icmp and fragmented messages
> > + * i.e. fragmented messages don't use ports.
> > + */
> > +static __u32 get_hash(struct sk_buff *skb, struct xt_hmark_info *info)
> > +{
> [...]
> > + ip_proto &= info->prmask;
> > + /* get a consistent hash (same value on both flow directions) */
> > + if (addr2 < addr1)
> > + swap(addr1, addr2);
>
> this assumption is not valid in NAT handlings.
That's true, because I want to avoid conntrack
>
> If you want consistent hashing with NAT handlings you'll have to make
> this stateful and use the conntrack source and reply directions of the
> original tuples (thus making it stateful). That may be a problem because
> some people may want to use this without enabling connection tracking.
What about a compilation switch or a sysctl ?
>
> Are you using this for (uplink) load balancing?
Actually in both ways
- in front of a bunch of ipvs
- and in the payloads for outgoing traffic.
> Could you also include one realistic example in the patch description on
> how this is used?
Sure, I guess you mean some nice ascii graphics,
iptables and ip route commands
>
> If this is accepted, I think this has to be merge with the (already
> overloaded) MARK target.
I have no opinion about that, others might have.
Thanks
Hans
next prev parent reply other threads:[~2011-02-03 14:23 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-02-03 13:34 [PATCH 0/2] NETFILTER new target module, HMARK Hans Schillstrom
2011-02-03 13:34 ` [PATCH] NETFILTER module xt_hmark new target for HASH MARK Hans Schillstrom
2011-02-03 13:51 ` Pablo Neira Ayuso
2011-02-03 14:23 ` Hans Schillstrom [this message]
2011-02-03 15:42 ` Pablo Neira Ayuso
2011-02-03 16:01 ` Pablo Neira Ayuso
2011-02-03 16:06 ` Jan Engelhardt
2011-02-03 16:08 ` Pablo Neira Ayuso
2011-02-03 16:32 ` Jan Engelhardt
2011-02-03 17:40 ` Hans Schillstrom
2011-02-03 17:37 ` Hans Schillstrom
2011-02-04 13:17 ` Patrick McHardy
2011-02-04 13:20 ` Patrick McHardy
2011-02-03 13:34 ` [PATCH] NETFILTER userspace part for target HMARK Hans Schillstrom
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1296742995.6662.57.camel@seasc0214 \
--to=hans.schillstrom@ericsson$(echo .)com \
--cc=hans@schillstrom$(echo .)com \
--cc=jengelh@medozas$(echo .)de \
--cc=kaber@trash$(echo .)net \
--cc=netdev@vger$(echo .)kernel.org \
--cc=netfilter-devel@vger$(echo .)kernel.org \
--cc=pablo@netfilter$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox