From: Patrick McHardy Date: Fri, 23 Dec 2011 13:00:13 +0000 (+0100) Subject: netfilter: nf_nat: use hash random for bysource hash X-Git-Tag: upstream/snapshot3+hdmi~8450^2~125^2~8 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=4d4e61c6ca683cdc0ea07d39c80cc8d6d478b31e;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git netfilter: nf_nat: use hash random for bysource hash Use nf_conntrack_hash_rnd in NAT bysource hash to avoid hash chain attacks. Signed-off-by: Patrick McHardy Acked-by: Eric Dumazet Signed-off-by: Pablo Neira Ayuso --- diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c index 58ab7a4..76600f8 100644 --- a/net/ipv4/netfilter/nf_nat_core.c +++ b/net/ipv4/netfilter/nf_nat_core.c @@ -57,7 +57,7 @@ hash_by_src(const struct net *net, u16 zone, /* Original src, to ensure we map it consistently if poss. */ hash = jhash_3words((__force u32)tuple->src.u3.ip, (__force u32)tuple->src.u.all ^ zone, - tuple->dst.protonum, 0); + tuple->dst.protonum, nf_conntrack_hash_rnd); return ((u64)hash * net->ipv4.nat_htable_size) >> 32; } diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 8b2842e..b76090f 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -67,6 +67,7 @@ DEFINE_PER_CPU(struct nf_conn, nf_conntrack_untracked); EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked); unsigned int nf_conntrack_hash_rnd __read_mostly; +EXPORT_SYMBOL_GPL(nf_conntrack_hash_rnd); static u32 hash_conntrack_raw(const struct nf_conntrack_tuple *tuple, u16 zone) {