<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - nftables - dynamic update for verdict map from the packet path"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1736#c9">Comment # 9</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - nftables - dynamic update for verdict map from the packet path"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1736">bug 1736</a>
from <span class="vcard"><a class="email" href="mailto:dinhtrason@gmail.com" title="dinhtrason@gmail.com">dinhtrason@gmail.com</a>
</span></b>
<pre><span class="quote">> BTW, you probably want to reserve ct mark == 0 for flow which is not yet
> pinned to an endpoint, which is the initial value for the conntrack mark
> anyway when the flow is created. Then, you have to adjust maps.
>
> Note that numgen random allows for offset, you could even try to make the ct
> mark unique, that is, ensure that each service has its own ct mark space.
> This goes with the idea of allowing you to use the existing conntrack
> userspace tool and as well netfilter logging to debug issues (eg. a flow
> going somewhere it should not).</span >
Got the idea. Thanks for your suggestion about using offset.
<span class="quote">>
> You mean you would like to support for map lookup then use the result as
> input for another verdict map lookup?</span >
Yes, Do you think it is reasonable to support such nested lookup?
Here is one test example of my commit.
# nft list ruleset
table ip loadbalancer {
map affinity-mappings {
type ipv4_addr : ipv4_addr
size 65535
flags dynamic,timeout
timeout 4m
elements = { 192.168.0.156 timeout 4m expires 3m59s996ms :
11.0.2.2, 192.168.0.211 timeout 4m expires 3m56s64ms : 11.0.2.1,
192.168.10.254 timeout 4m expires 3m53s974ms :
11.0.2.2 }
}
map epToChain {
type ipv4_addr : verdict
elements = { 11.0.2.1 : goto endpoint-1, 11.0.2.2 : goto
endpoint-2 }
}
chain endpoint-1 {
counter packets 2 bytes 224
update @affinity-mappings { ip saddr : 11.0.2.1 }
}
chain endpoint-2 {
counter packets 203 bytes 11940
update @affinity-mappings { ip saddr : 11.0.2.2 }
}
chain service-ABC {
ip saddr map @affinity-mappings vmap @epToChain
numgen random mod 2 vmap { 0 : goto endpoint-1, 1 : goto
endpoint-2 }
}
chain prerouting {
type filter hook prerouting priority filter; policy accept;
goto service-ABC
}
}</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>