[Bug 1736] nftables - dynamic update for verdict map from the packet path

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1736

--- Comment #9 from dinhtrason at gmail.com ---
> BTW, you probably want to reserve ct mark == 0 for flow which is not yet
> pinned to an endpoint, which is the initial value for the conntrack mark
> anyway when the flow is created. Then, you have to adjust maps.
> 
> Note that numgen random allows for offset, you could even try to make the ct
> mark unique, that is, ensure that each service has its own ct mark space.
> This goes with the idea of allowing you to use the existing conntrack
> userspace tool and as well netfilter logging to debug issues (eg. a flow
> going somewhere it should not).

Got the idea. Thanks for your suggestion about using offset.

> 
> You mean you would like to support for map lookup then use the result as
> input for another verdict map lookup?

Yes, Do you think it is reasonable to support such nested lookup? 

Here is one test example of my commit.

# nft list ruleset
table ip loadbalancer {
        map affinity-mappings {
                type ipv4_addr : ipv4_addr
                size 65535
                flags dynamic,timeout
                timeout 4m
                elements = { 192.168.0.156 timeout 4m expires 3m59s996ms :
11.0.2.2, 192.168.0.211 timeout 4m expires 3m56s64ms : 11.0.2.1,
                             192.168.10.254 timeout 4m expires 3m53s974ms :
11.0.2.2 }
        }

        map epToChain {
                type ipv4_addr : verdict
                elements = { 11.0.2.1 : goto endpoint-1, 11.0.2.2 : goto
endpoint-2 }
        }

        chain endpoint-1 {
                counter packets 2 bytes 224
                update @affinity-mappings { ip saddr : 11.0.2.1 }
        }

        chain endpoint-2 {
                counter packets 203 bytes 11940
                update @affinity-mappings { ip saddr : 11.0.2.2 }
        }

        chain service-ABC {
                ip saddr map @affinity-mappings vmap @epToChain
                numgen random mod 2 vmap { 0 : goto endpoint-1, 1 : goto
endpoint-2 }
        }

        chain prerouting {
                type filter hook prerouting priority filter; policy accept;
                goto service-ABC
        }
}

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20240320/37894050/attachment-0001.html>