On Wed, May 24, 2017 at 05:46:15PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> > On Wed, May 24, 2017 at 06:01:51PM +0530, Shyam Saini wrote:
> > > Add translation for cluster to nft
> >
> > I think this should be:
> >
> > -m cluster --cluster-total-nodes 2 --cluster-local-node 1 --cluster-hash-seed 0xdeadbeef
> >
> > should be translated to:
> >
> > jhash ct original saddr mod 2 seed 0xdeadbeef eq 0
> >
> > if --cluster-local-node is 2, then:
> >
> > jhash ct original saddr mod 2 seed 0xdeadbeef eq 1
>
> Looks good. But I think we need to take care of mangling pkttype as
> well, right?
We should if we want to 1:1 translation, yes.
Actually, if we rely on the nft arp mac address mangling (to use
multicast ethernet address, ie. RFC violation to cheat dummy switch
just in case you need this to get a packet flooded to two ports), we
could just do this upfront in the ruleset, ie.
ether daddr 01:00:5e:00:01:01 meta set pkttype host
Using the mac address that we set to arp replies, instead of blind
mangling the mac address.
Anyway, yes, something like:
jhash ct original saddr mod 2 seed 0xdeadbeef eq 0 meta pkttype set host
should be good enough.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
