Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7001c6d1 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: use get_random_once for nat and expectations 



Use a private seed and init it using get_random_once.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent a3efd812

net/netfilter/nf_conntrack_expect.c

+3 −4
Original line number Diff line number Diff line
@@ -38,6 +38,7 @@ EXPORT_SYMBOL_GPL(nf_ct_expect_hsize); 
unsigned int nf_ct_expect_max __read_mostly;



static struct kmem_cache *nf_ct_expect_cachep __read_mostly;

static unsigned int nf_ct_expect_hashrnd __read_mostly;



/* nf_conntrack_expect helper functions */

void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp,
@@ -76,13 +77,11 @@ static unsigned int nf_ct_expect_dst_hash(const struct nf_conntrack_tuple *tuple 
{

	unsigned int hash;



	if (unlikely(!nf_conntrack_hash_rnd)) {

		init_nf_conntrack_hash_rnd();

	}

	get_random_once(&nf_ct_expect_hashrnd, sizeof(nf_ct_expect_hashrnd));



	hash = jhash2(tuple->dst.u3.all, ARRAY_SIZE(tuple->dst.u3.all),

		      (((tuple->dst.protonum ^ tuple->src.l3num) << 16) |

		       (__force __u16)tuple->dst.u.all) ^ nf_conntrack_hash_rnd);

		       (__force __u16)tuple->dst.u.all) ^ nf_ct_expect_hashrnd);



	return reciprocal_scale(hash, nf_ct_expect_hsize);

}

net/netfilter/nf_nat_core.c

+4 −2
Original line number Diff line number Diff line
@@ -37,7 +37,7 @@ static const struct nf_nat_l3proto __rcu *nf_nat_l3protos[NFPROTO_NUMPROTO] 
						__read_mostly;

static const struct nf_nat_l4proto __rcu **nf_nat_l4protos[NFPROTO_NUMPROTO]

						__read_mostly;



static unsigned int nf_nat_hash_rnd __read_mostly;



inline const struct nf_nat_l3proto *

__nf_nat_l3proto_find(u8 family)
@@ -122,9 +122,11 @@ hash_by_src(const struct net *net, const struct nf_conntrack_tuple *tuple) 
{

	unsigned int hash;



	get_random_once(&nf_nat_hash_rnd, sizeof(nf_nat_hash_rnd));



	/* Original src, to ensure we map it consistently if poss. */

	hash = jhash2((u32 *)&tuple->src, sizeof(tuple->src) / sizeof(u32),

		      tuple->dst.protonum ^ nf_conntrack_hash_rnd);

		      tuple->dst.protonum ^ nf_nat_hash_rnd);



	return reciprocal_scale(hash, net->ct.nat_htable_size);

}