Commit 5abd363f authored by Patrick McHardy's avatar Patrick McHardy

[NETFILTER]: nf_nat: fix random mode not to overwrite port rover

The port rover should not get overwritten when using random mode,
otherwise other rules will also use more or less random ports.
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent 937e0dfd
...@@ -42,6 +42,7 @@ int nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple, ...@@ -42,6 +42,7 @@ int nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
{ {
unsigned int range_size, min, i; unsigned int range_size, min, i;
__be16 *portptr; __be16 *portptr;
u_int16_t off;
if (maniptype == IP_NAT_MANIP_SRC) if (maniptype == IP_NAT_MANIP_SRC)
portptr = &tuple->src.u.all; portptr = &tuple->src.u.all;
...@@ -72,13 +73,17 @@ int nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple, ...@@ -72,13 +73,17 @@ int nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
range_size = ntohs(range->max.all) - min + 1; range_size = ntohs(range->max.all) - min + 1;
} }
off = *rover;
if (range->flags & IP_NAT_RANGE_PROTO_RANDOM) if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
*rover = net_random(); off = net_random();
for (i = 0; i < range_size; i++, (*rover)++) { for (i = 0; i < range_size; i++, off++) {
*portptr = htons(min + *rover % range_size); *portptr = htons(min + off % range_size);
if (!nf_nat_used_tuple(tuple, ct)) if (nf_nat_used_tuple(tuple, ct))
return 1; continue;
if (!(range->flags & IP_NAT_RANGE_PROTO_RANDOM))
*rover = off;
return 1;
} }
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment