[Bug 1736] nftables - dynamic update for verdict map from the packet path

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1736

--- Comment #16 from dinhtrason at gmail.com ---
Jumping always to chain 'candidate-endpoint-x' prior to looking up the affinity
map seems to be a trick that helps update the timeout of the cached source IPs.
It looks a bit unusual, but seems to work fine.

There are two options suggested so far:

1/ Use two maps with 'ct mark' to lookup the target endpoint 

table ip loadbalancer {
        map affinityMapToEP {
                type ipv4_addr : mark
                size 65535
                flags dynamic,timeout
                timeout 4m
                elements = { 192.168.0.156 timeout 4m expires 3m58s644ms :
0x00000002 }
        }

        map affinityGotoChain {
                type mark : verdict
                flags dynamic
                elements = { 0x00000001 : goto endpoint-1, 0x00000002 : goto
endpoint-2 }
        }

        chain endpoint-1 {
                update @affinityMapToEP { ip saddr : 0x00000001 }
                meta l4proto tcp dnat to 11.0.2.1:5001
        }

        chain endpoint-2 {
                update @affinityMapToEP { ip saddr : 0x00000002 }
                meta l4proto tcp dnat to 11.0.2.2:5001
        }

        chain service-ABC {
                ct mark set ip saddr map @affinityMapToEP
                ct mark vmap @affinityGotoChain
                numgen random mod 2 vmap { 0 : goto endpoint-1, 1 : goto
endpoint-2 }
        }

        chain prerouting {
                type nat hook prerouting priority dstnat; policy accept;
                tcp dport 32001 goto service-ABC
        }
}

2/ Use one map only and DNAT directly to endpoint address

table ip loadbalancer {
        map affinity-mappings {
                type ipv4_addr : ipv4_addr
                size 65535
                flags dynamic,timeout
                timeout 4m
                elements = { 192.168.0.156 timeout 4m expires 3m58s702ms :
11.0.2.1 }
        }

        chain endpoint-1 {
                update @affinity-mappings { ip saddr : 11.0.2.1 }
        }

        chain endpoint-2 {
                update @affinity-mappings { ip saddr : 11.0.2.2 }
        }

        chain service-ABC {
                numgen random mod 2 vmap { 0 : jump endpoint-1, 1 : jump
endpoint-2 }
                meta l4proto tcp dnat to ip saddr map @affinity-mappings:5001
        }

        chain prerouting {
                type nat hook prerouting priority dstnat; policy accept;
                tcp dport 32001 goto service-ABC
        }
}

I verified both options. They work for my case with some PROS and CONS. I will
need to tailor and promote one of them to k8s community.

Thanks again for your support with the detailed examples.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20240326/e445f723/attachment.html>