Attachment 314892 Details for Bug 459943 – Upstream patch for this issue

[patch] Upstream patch for this issue

0001--NETFILTER-NAT-optional-source-port-randomization.patch (text/plain), 7.83 KB, created by Eugene Teo (Security Response) on 2008-08-25 01:50:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eugene Teo (Security Response)

Created: 2008-08-25 01:50:29 UTC

Size: 7.83 KB

patch

obsolete

>From 41f4689a7c8cd76b77864461b3c58fde8f322b2c Mon Sep 17 00:00:00 2001
>From: Eric Leblond <eric@inl.fr>
>Date: Wed, 7 Feb 2007 15:10:09 -0800
>Subject: [PATCH] [NETFILTER]: NAT: optional source port randomization support
>
>This patch adds support to NAT to randomize source ports.
>
>Signed-off-by: Eric Leblond <eric@inl.fr>
>Signed-off-by: Patrick McHardy <kaber@trash.net>
>Signed-off-by: David S. Miller <davem@davemloft.net>
>---
> include/linux/netfilter_ipv4/ip_nat.h |    1 +
> include/net/netfilter/nf_nat.h        |    1 +
> net/ipv4/netfilter/ip_nat_core.c      |   12 ++++++++++--
> net/ipv4/netfilter/ip_nat_proto_tcp.c |    5 +++++
> net/ipv4/netfilter/ip_nat_proto_udp.c |    5 +++++
> net/ipv4/netfilter/ip_nat_rule.c      |    4 ++++
> net/ipv4/netfilter/nf_nat_core.c      |   12 ++++++++++--
> net/ipv4/netfilter/nf_nat_proto_tcp.c |    4 ++++
> net/ipv4/netfilter/nf_nat_proto_udp.c |    4 ++++
> net/ipv4/netfilter/nf_nat_rule.c      |    4 ++++
> 10 files changed, 48 insertions(+), 4 deletions(-)
>
>diff --git a/include/linux/netfilter_ipv4/ip_nat.h b/include/linux/netfilter_ipv4/ip_nat.h
>index bdf5536..bbca89a 100644
>--- a/include/linux/netfilter_ipv4/ip_nat.h
>+++ b/include/linux/netfilter_ipv4/ip_nat.h
>@@ -16,6 +16,7 @@ enum ip_nat_manip_type
> 
> #define IP_NAT_RANGE_MAP_IPS 1
> #define IP_NAT_RANGE_PROTO_SPECIFIED 2
>+#define IP_NAT_RANGE_PROTO_RANDOM 4 /* add randomness to "port" selection */
> 
> /* NAT sequence number modifications */
> struct ip_nat_seq {
>diff --git a/include/net/netfilter/nf_nat.h b/include/net/netfilter/nf_nat.h
>index 61c6206..bc57dd7 100644
>--- a/include/net/netfilter/nf_nat.h
>+++ b/include/net/netfilter/nf_nat.h
>@@ -16,6 +16,7 @@ enum nf_nat_manip_type
> 
> #define IP_NAT_RANGE_MAP_IPS 1
> #define IP_NAT_RANGE_PROTO_SPECIFIED 2
>+#define IP_NAT_RANGE_PROTO_RANDOM 4
> 
> /* NAT sequence number modifications */
> struct nf_nat_seq {
>diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c
>index 9d1a517..5e08c2b 100644
>--- a/net/ipv4/netfilter/ip_nat_core.c
>+++ b/net/ipv4/netfilter/ip_nat_core.c
>@@ -246,8 +246,9 @@ get_unique_tuple(struct ip_conntrack_tuple *tuple,
> 	if (maniptype == IP_NAT_MANIP_SRC) {
> 		if (find_appropriate_src(orig_tuple, tuple, range)) {
> 			DEBUGP("get_unique_tuple: Found current src map\n");
>-			if (!ip_nat_used_tuple(tuple, conntrack))
>-				return;
>+			if (!(range->flags & IP_NAT_RANGE_PROTO_RANDOM))
>+				if (!ip_nat_used_tuple(tuple, conntrack))
>+					return;
> 		}
> 	}
> 
>@@ -261,6 +262,13 @@ get_unique_tuple(struct ip_conntrack_tuple *tuple,
> 
> 	proto = ip_nat_proto_find_get(orig_tuple->dst.protonum);
> 
>+	/* Change protocol info to have some randomization */
>+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM) {
>+		proto->unique_tuple(tuple, range, maniptype, conntrack);
>+		ip_nat_proto_put(proto);
>+		return;
>+	}
>+
> 	/* Only bother mapping if it's not already in range and unique */
> 	if ((!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)
> 	     || proto->in_range(tuple, maniptype, &range->min, &range->max))
>diff --git a/net/ipv4/netfilter/ip_nat_proto_tcp.c b/net/ipv4/netfilter/ip_nat_proto_tcp.c
>index b586d18..14ff24f 100644
>--- a/net/ipv4/netfilter/ip_nat_proto_tcp.c
>+++ b/net/ipv4/netfilter/ip_nat_proto_tcp.c
>@@ -8,6 +8,7 @@
> 
> #include <linux/types.h>
> #include <linux/init.h>
>+#include <linux/random.h>
> #include <linux/netfilter.h>
> #include <linux/ip.h>
> #include <linux/tcp.h>
>@@ -75,6 +76,10 @@ tcp_unique_tuple(struct ip_conntrack_tuple *tuple,
> 		range_size = ntohs(range->max.tcp.port) - min + 1;
> 	}
> 
>+	/* Start from random port to avoid prediction */
>+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
>+		port =  net_random();
>+
> 	for (i = 0; i < range_size; i++, port++) {
> 		*portptr = htons(min + port % range_size);
> 		if (!ip_nat_used_tuple(tuple, conntrack)) {
>diff --git a/net/ipv4/netfilter/ip_nat_proto_udp.c b/net/ipv4/netfilter/ip_nat_proto_udp.c
>index 5ced087..dfd5216 100644
>--- a/net/ipv4/netfilter/ip_nat_proto_udp.c
>+++ b/net/ipv4/netfilter/ip_nat_proto_udp.c
>@@ -8,6 +8,7 @@
> 
> #include <linux/types.h>
> #include <linux/init.h>
>+#include <linux/random.h>
> #include <linux/netfilter.h>
> #include <linux/ip.h>
> #include <linux/udp.h>
>@@ -74,6 +75,10 @@ udp_unique_tuple(struct ip_conntrack_tuple *tuple,
> 		range_size = ntohs(range->max.udp.port) - min + 1;
> 	}
> 
>+	/* Start from random port to avoid prediction */
>+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
>+		port = net_random();
>+
> 	for (i = 0; i < range_size; i++, port++) {
> 		*portptr = htons(min + port % range_size);
> 		if (!ip_nat_used_tuple(tuple, conntrack))
>diff --git a/net/ipv4/netfilter/ip_nat_rule.c b/net/ipv4/netfilter/ip_nat_rule.c
>index a176aa3..6ebaad3 100644
>--- a/net/ipv4/netfilter/ip_nat_rule.c
>+++ b/net/ipv4/netfilter/ip_nat_rule.c
>@@ -193,6 +193,10 @@ static int ipt_dnat_checkentry(const char *tablename,
> 		printk("DNAT: multiple ranges no longer supported\n");
> 		return 0;
> 	}
>+	if (mr->range[0].flags & IP_NAT_RANGE_PROTO_RANDOM) {
>+		printk("DNAT: port randomization not supported\n");
>+		return 0;
>+	}
> 	return 1;
> }
> 
>diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
>index 86a9227..998b255 100644
>--- a/net/ipv4/netfilter/nf_nat_core.c
>+++ b/net/ipv4/netfilter/nf_nat_core.c
>@@ -254,8 +254,9 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
> 	if (maniptype == IP_NAT_MANIP_SRC) {
> 		if (find_appropriate_src(orig_tuple, tuple, range)) {
> 			DEBUGP("get_unique_tuple: Found current src map\n");
>-			if (!nf_nat_used_tuple(tuple, ct))
>-				return;
>+			if (!(range->flags & IP_NAT_RANGE_PROTO_RANDOM))
>+				if (!nf_nat_used_tuple(tuple, ct))
>+					return;
> 		}
> 	}
> 
>@@ -269,6 +270,13 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
> 
> 	proto = nf_nat_proto_find_get(orig_tuple->dst.protonum);
> 
>+	/* Change protocol info to have some randomization */
>+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM) {
>+		proto->unique_tuple(tuple, range, maniptype, ct);
>+		nf_nat_proto_put(proto);
>+		return;
>+	}
>+
> 	/* Only bother mapping if it's not already in range and unique */
> 	if ((!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED) ||
> 	     proto->in_range(tuple, maniptype, &range->min, &range->max)) &&
>diff --git a/net/ipv4/netfilter/nf_nat_proto_tcp.c b/net/ipv4/netfilter/nf_nat_proto_tcp.c
>index 7e26a7e..439164c 100644
>--- a/net/ipv4/netfilter/nf_nat_proto_tcp.c
>+++ b/net/ipv4/netfilter/nf_nat_proto_tcp.c
>@@ -8,6 +8,7 @@
> 
> #include <linux/types.h>
> #include <linux/init.h>
>+#include <linux/random.h>
> #include <linux/ip.h>
> #include <linux/tcp.h>
> 
>@@ -75,6 +76,9 @@ tcp_unique_tuple(struct nf_conntrack_tuple *tuple,
> 		range_size = ntohs(range->max.tcp.port) - min + 1;
> 	}
> 
>+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
>+		port =  net_random();
>+
> 	for (i = 0; i < range_size; i++, port++) {
> 		*portptr = htons(min + port % range_size);
> 		if (!nf_nat_used_tuple(tuple, ct))
>diff --git a/net/ipv4/netfilter/nf_nat_proto_udp.c b/net/ipv4/netfilter/nf_nat_proto_udp.c
>index ab0ce4c..8cae6e0 100644
>--- a/net/ipv4/netfilter/nf_nat_proto_udp.c
>+++ b/net/ipv4/netfilter/nf_nat_proto_udp.c
>@@ -8,6 +8,7 @@
> 
> #include <linux/types.h>
> #include <linux/init.h>
>+#include <linux/random.h>
> #include <linux/ip.h>
> #include <linux/udp.h>
> 
>@@ -73,6 +74,9 @@ udp_unique_tuple(struct nf_conntrack_tuple *tuple,
> 		range_size = ntohs(range->max.udp.port) - min + 1;
> 	}
> 
>+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
>+		port = net_random();
>+
> 	for (i = 0; i < range_size; i++, port++) {
> 		*portptr = htons(min + port % range_size);
> 		if (!nf_nat_used_tuple(tuple, ct))
>diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
>index b868ee0..3745efe 100644
>--- a/net/ipv4/netfilter/nf_nat_rule.c
>+++ b/net/ipv4/netfilter/nf_nat_rule.c
>@@ -226,6 +226,10 @@ static int ipt_dnat_checkentry(const char *tablename,
> 		printk("DNAT: multiple ranges no longer supported\n");
> 		return 0;
> 	}
>+	if (mr->range[0].flags & IP_NAT_RANGE_PROTO_RANDOM) {
>+		printk("DNAT: port randomization not supported\n");
>+		return 0;
>+	}
> 	return 1;
> }
> 
>-- 
>1.5.5.1
>

Actions: View | Diff

Attachments on bug 459943: 314892 | 314893 | 337289 | 356120