On Thu, 2011-02-03 at 14:51 +0100, Pablo Neira Ayuso wrote:
> On 03/02/11 14:34, Hans Schillstrom wrote:
> > +/*
> > + * Calc hash value, special casre is taken on icmp and fragmented messages
> > + * i.e. fragmented messages don't use ports.
> > + */
> > +static __u32 get_hash(struct sk_buff *skb, struct xt_hmark_info *info)
> > +{
> [...]
> > + ip_proto &= info->prmask;
> > + /* get a consistent hash (same value on both flow directions) */
> > + if (addr2 < addr1)
> > + swap(addr1, addr2);
>
> this assumption is not valid in NAT handlings.
That's true, because I want to avoid conntrack
>
> If you want consistent hashing with NAT handlings you'll have to make
> this stateful and use the conntrack source and reply directions of the
> original tuples (thus making it stateful). That may be a problem because
> some people may want to use this without enabling connection tracking.
What about a compilation switch or a sysctl ?
>
> Are you using this for (uplink) load balancing?
Actually in both ways
- in front of a bunch of ipvs
- and in the payloads for outgoing traffic.
> Could you also include one realistic example in the patch description on
> how this is used?
Sure, I guess you mean some nice ascii graphics,
iptables and ip route commands
>
> If this is accepted, I think this has to be merge with the (already
> overloaded) MARK target.
I have no opinion about that, others might have.
Thanks
Hans
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
