diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-10-17 21:52:37 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-10-17 21:52:37 +0200 |
| commit | 938140bfe512e8464a5880ae5e7f5c93700765ec (patch) | |
| tree | 170cbb43aae02b0de4f183584e0fed65c6e71840 /python | |
| parent | 385cafdcbb10e90c04462bc8e17fcf89e483382a (diff) | |
| download | vyos-1x-938140bfe512e8464a5880ae5e7f5c93700765ec.tar.gz vyos-1x-938140bfe512e8464a5880ae5e7f5c93700765ec.zip | |
nat: T9475: load-balance weights are relative to their sum
The hash for load-balanced NAT rules was always taken modulo 100, while
backend weights may add up to any value. With a sum below 100 some hash
values had no backend in the map; commit only warned about it.
The modulus is now the sum of all weights, so every hash value maps to a
backend and weights act as relative shares. Rules whose weights add up to
100 render exactly as before, and the warning is dropped.
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/nat.py | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/python/vyos/nat.py b/python/vyos/nat.py index 1fdbc2037..e70c6b846 100644 --- a/python/vyos/nat.py +++ b/python/vyos/nat.py @@ -141,9 +141,12 @@ def parse_nat_rule(rule_conf, rule_id, nat_type, ipv6=False): current_prob = current_prob + item_prob elements = ' , '.join(nat_map) + # weights are relative - a modulus other than their sum leaves hash + # values without a backend + modulus = current_prob if 'hash' in rule_conf['load_balance'] and 'random' in rule_conf['load_balance']['hash']: - translation_str += ' numgen random mod 100 map ' + '{ ' + f'{elements}' + ' }' + translation_str += f' numgen random mod {modulus} map ' + '{ ' + f'{elements}' + ' }' else: for input_param in rule_conf['load_balance']['hash']: if input_param == 'source-address': @@ -158,7 +161,7 @@ def parse_nat_rule(rule_conf, rule_id, nat_type, ipv6=False): param = f'{prot} dport' hash_input_items.append(param) hash_input = ' . '.join(hash_input_items) - translation_str += f' jhash ' + f'{hash_input}' + ' mod 100 map ' + '{ ' + f'{elements}' + ' }' + translation_str += f' jhash ' + f'{hash_input}' + f' mod {modulus} map ' + '{ ' + f'{elements}' + ' }' for target in ['source', 'destination']: if target not in rule_conf: |