netfilter: nf_nat: use hash random for bysource hash
Use nf_conntrack_hash_rnd in NAT bysource hash to avoid hash chain attacks. Signed-off-by: Patrick McHardy <kaber@trash.net> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
cbc9f2f4fc
commit
4d4e61c6ca
|
@ -57,7 +57,7 @@ hash_by_src(const struct net *net, u16 zone,
|
||||||
/* Original src, to ensure we map it consistently if poss. */
|
/* Original src, to ensure we map it consistently if poss. */
|
||||||
hash = jhash_3words((__force u32)tuple->src.u3.ip,
|
hash = jhash_3words((__force u32)tuple->src.u3.ip,
|
||||||
(__force u32)tuple->src.u.all ^ zone,
|
(__force u32)tuple->src.u.all ^ zone,
|
||||||
tuple->dst.protonum, 0);
|
tuple->dst.protonum, nf_conntrack_hash_rnd);
|
||||||
return ((u64)hash * net->ipv4.nat_htable_size) >> 32;
|
return ((u64)hash * net->ipv4.nat_htable_size) >> 32;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -67,6 +67,7 @@ DEFINE_PER_CPU(struct nf_conn, nf_conntrack_untracked);
|
||||||
EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked);
|
EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked);
|
||||||
|
|
||||||
unsigned int nf_conntrack_hash_rnd __read_mostly;
|
unsigned int nf_conntrack_hash_rnd __read_mostly;
|
||||||
|
EXPORT_SYMBOL_GPL(nf_conntrack_hash_rnd);
|
||||||
|
|
||||||
static u32 hash_conntrack_raw(const struct nf_conntrack_tuple *tuple, u16 zone)
|
static u32 hash_conntrack_raw(const struct nf_conntrack_tuple *tuple, u16 zone)
|
||||||
{
|
{
|
||||||
|
|
Loading…
Reference in New Issue