Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

netfilter: nft_numgen: enable hashing of one element

The modulus in the hash function was limited to > 1 as initially
there was no sense to create a hashing of just one element.

Nevertheless, there are certain cases specially for load balancing
where this case needs to be addressed.

This patch fixes the following error.

Error: Could not process rule: Numerical result out of range
add rule ip nftlb lb01 dnat to jhash ip saddr mod 1 map { 0: 192.168.0.10 }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The solution comes to force the hash to 0 when the modulus is 1.

Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>

authored by

Laura Garcia Liebana and committed by
Pablo Neira Ayuso
75e72f05 d734a288

+1 -1
+1 -1
net/netfilter/nft_hash.c
··· 97 97 priv->len = len; 98 98 99 99 priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS])); 100 - if (priv->modulus <= 1) 100 + if (priv->modulus < 1) 101 101 return -ERANGE; 102 102 103 103 if (priv->offset + priv->modulus - 1 < priv->offset)