Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a42b99a6 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: avoid get_random_bytes calls 



All these users need an initial seed value for jhash, prandom is
perfectly fine.  This avoids draining the entropy pool where
its not strictly required.

nfnetlink_log did not use the random value at all.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 8cf4d6a2

net/netfilter/nfnetlink_log.c

+0 −8
Original line number Diff line number Diff line
@@ -28,8 +28,6 @@ 
#include <linux/proc_fs.h>

#include <linux/security.h>

#include <linux/list.h>

#include <linux/jhash.h>

#include <linux/random.h>

#include <linux/slab.h>

#include <net/sock.h>

#include <net/netfilter/nf_log.h>
@@ -75,7 +73,6 @@ struct nfulnl_instance { 
};



#define INSTANCE_BUCKETS	16

static unsigned int hash_init;



static int nfnl_log_net_id __read_mostly;
@@ -1066,11 +1063,6 @@ static int __init nfnetlink_log_init(void) 
{

	int status = -ENOMEM;



	/* it's not really all that important to have a random value, so

	 * we can do this from the init function, even if there hasn't

	 * been that much entropy yet */

	get_random_bytes(&hash_init, sizeof(hash_init));



	netlink_register_notifier(&nfulnl_rtnl_notifier);

	status = nfnetlink_subsys_register(&nfulnl_subsys);

	if (status < 0) {

net/netfilter/nft_hash.c

+1 −1
Original line number Diff line number Diff line
@@ -164,7 +164,7 @@ static int nft_hash_init(const struct nft_set *set, 
	unsigned int cnt, i;



	if (unlikely(!nft_hash_rnd_initted)) {

		get_random_bytes(&nft_hash_rnd, 4);

		nft_hash_rnd = prandom_u32();

		nft_hash_rnd_initted = true;

	}

net/netfilter/xt_RATEEST.c

+1 −1
Original line number Diff line number Diff line
@@ -100,7 +100,7 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par) 
	int ret;



	if (unlikely(!rnd_inited)) {

		get_random_bytes(&jhash_rnd, sizeof(jhash_rnd));

		jhash_rnd = prandom_u32();

		rnd_inited = true;

	}

net/netfilter/xt_connlimit.c

+1 −1
Original line number Diff line number Diff line
@@ -229,7 +229,7 @@ static int connlimit_mt_check(const struct xt_mtchk_param *par) 
		u_int32_t rand;



		do {

			get_random_bytes(&rand, sizeof(rand));

			rand = prandom_u32();

		} while (!rand);

		cmpxchg(&connlimit_rnd, 0, rand);

	}

net/netfilter/xt_hashlimit.c

+1 −1
Original line number Diff line number Diff line
@@ -177,7 +177,7 @@ dsthash_alloc_init(struct xt_hashlimit_htable *ht, 
	/* initialize hash with random val at the time we allocate

	 * the first hashtable entry */

	if (unlikely(!ht->rnd_initialized)) {

		get_random_bytes(&ht->rnd, sizeof(ht->rnd));

		ht->rnd = prandom_u32();

		ht->rnd_initialized = true;

	}