flowhash

func Hash ¶

func Hash(key uint64, ipPacket []byte) uint16

Hash computes a symmetric, keyed flow hash for the given IP packet. It returns a 16-bit value derived from the source/destination IP addresses and the L4 source/destination ports (for TCP/UDP), or the protocol number otherwise, canonicalized so the two directions of a flow hash identically (stable ECMP). If the packet is invalid or the IP version unsupported it returns 0.

key is a per-session secret mixed into the hash: it makes the resulting outer UDP source port no longer a public function of the inner 5-tuple, so an off-path observer cannot fingerprint or correlate inner flows from it (APO-661). Both directions on one handler share the key, preserving the symmetric ECMP property within a session while denying an outsider the mapping.

func MapToEphemeralPort ¶ added in v0.17.0

func MapToEphemeralPort(hash uint16) uint16

MapToEphemeralPort maps a given hash value to the ephemeral port range (49152-65535).