Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4d4e61c6 authored Dec 23, 2011 by Patrick McHardy Committed by Pablo Neira Ayuso Dec 23, 2011

netfilter: nf_nat: use hash random for bysource hash



Use nf_conntrack_hash_rnd in NAT bysource hash to avoid hash chain attacks.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent cbc9f2f4

net/ipv4/netfilter/nf_nat_core.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -57,7 +57,7 @@ hash_by_src(const struct net *net, u16 zone,
	/* Original src, to ensure we map it consistently if poss. */		/* Original src, to ensure we map it consistently if poss. */
	hash = jhash_3words((__force u32)tuple->src.u3.ip,		hash = jhash_3words((__force u32)tuple->src.u3.ip,
	(__force u32)tuple->src.u.all ^ zone,		(__force u32)tuple->src.u.all ^ zone,
	tuple->dst.protonum, 0);		tuple->dst.protonum, nf_conntrack_hash_rnd);
	return ((u64)hash * net->ipv4.nat_htable_size) >> 32;		return ((u64)hash * net->ipv4.nat_htable_size) >> 32;
	}		}

net/netfilter/nf_conntrack_core.c

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -67,6 +67,7 @@ DEFINE_PER_CPU(struct nf_conn, nf_conntrack_untracked);
	EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked);		EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked);

	unsigned int nf_conntrack_hash_rnd __read_mostly;		unsigned int nf_conntrack_hash_rnd __read_mostly;
			EXPORT_SYMBOL_GPL(nf_conntrack_hash_rnd);

	static u32 hash_conntrack_raw(const struct nf_conntrack_tuple *tuple, u16 zone)		static u32 hash_conntrack_raw(const struct nf_conntrack_tuple *tuple, u16 zone)
	{		{