]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: remove NF_NAT_RANGE_PROTO_RANDOM support
authorFlorian Westphal <fw@strlen.de>
Thu, 13 Dec 2018 15:01:27 +0000 (16:01 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 17 Dec 2018 22:32:36 +0000 (23:32 +0100)
commit8bc7f128d14bd055ada893d19bb1014e14dd1438
tree755dea0c481c601888c262c31dcf7d2906581ad8
parent279f9c92e08cbb8073c89d3f22c2b1f9b505ddbc
netfilter: remove NF_NAT_RANGE_PROTO_RANDOM support

Historically this was net_random() based, and was then converted to
a hash based algorithm (private boot seed + hash of endpoint addresses)
due to concerns of leaking net_random() bits.

RANDOM_FULLY mode was added later to avoid problems with hash
based mode (see commit 8c737b16da4ab,
"netfilter: nf_nat: add full port randomization support" for details).

Just make prandom_u32() the default search starting point and get rid of
->secure_port() altogether.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/net/netfilter/nf_nat_l3proto.h
net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
net/netfilter/nf_nat_proto_common.c