<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - nftables - dynamic update for verdict map from the packet path"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1736#c14">Comment # 14</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - nftables - dynamic update for verdict map from the packet path"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1736">bug 1736</a>
from <span class="vcard"><a class="email" href="mailto:pablo@netfilter.org" title="Pablo Neira Ayuso <pablo@netfilter.org>"> <span class="fn">Pablo Neira Ayuso</span></a>
</span></b>
<pre>(In reply to dinhtrason from <a href="show_bug.cgi?id=1736#c13">comment #13</a>)
<span class="quote">> I did not even think about the race condition. Thanks for highlighting this
> special case.</span >
table ip loadbalancer {
map affinity-mappings {
type ipv4_addr : ipv4_addr
size 65535
flags dynamic,timeout
timeout 4m
}
chain candidate-endpoint-1 {
update @affinity-mappings { ip saddr counter : 11.0.2.1 }
}
chain candidate-endpoint-2 {
update @affinity-mappings { ip saddr counter : 11.0.2.2 }
}
chain service-ABC {
numgen random mod 2 vmap { 0 : goto candidate-endpoint-1, 1 :
goto candidate-endpoint-2 }
meta l4proto tcp dnat to ip saddr map @affinity-mappings : 5001
}
}
The idea is:
1) Update/refresh the mapping first. If the mapping already exists, refresh the
timeout for such existing mapping, note that the existing mapping is left as is
if it exists (update does not override an existing mapping). If the mapping
does not exist, then the new mapping entry gets added.
2) Then, look up for the DNAT mapping.
BTW; I have placed counters after the key in the update statement, then update
bumps the corresponding counters for the existing/new mapping in your
@affinity-mapping.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>