Attachment 316250 Details for Bug 459942 – Patch for MRG 2.6.24.7-79

[patch] Patch for MRG 2.6.24.7-79

bz459942--0001-nf_nat-use-secure_ipv4_port_ephemeral-for-NAT-por.patch (text/plain), 2.91 KB, created by Luis Claudio R. Goncalves on 2008-09-09 19:55:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Luis Claudio R. Goncalves

Created: 2008-09-09 19:55:36 UTC

Size: 2.91 KB

patch

obsolete

>Adpated the patch below following the guidelines from Eugene.
>
>| -------  Comment #3 From  Eugene Teo (Security Response Team) 
>| for the realtime kernel, there isn't a unified unique_tuple routine, so both
>| udp_unique_tuple and tcp_unique_tuple routines need to be addressed.
>
>
>
>| From 9f593653742d1dd816c4e94c6e5154a57ccba6d1 Mon Sep 17 00:00:00 2001
>| From: Stephen Hemminger <shemminger@vyatta.com>
>| Date: Mon, 18 Aug 2008 21:32:32 -0700
>| Subject: [PATCH] nf_nat: use secure_ipv4_port_ephemeral() for NAT port randomization
>| 
>| Use incoming network tuple as seed for NAT port randomization.
>| This avoids concerns of leaking net_random() bits, and also gives better
>| port distribution. Don't have NAT server, compile tested only.
>| 
>| Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
>| 
>| [ added missing EXPORT_SYMBOL_GPL ]
>| 
>| Signed-off-by: Patrick McHardy <kaber@trash.net>
>| Signed-off-by: David S. Miller <davem@davemloft.net>
>| ---
>|  drivers/char/random.c                    |    1 +
>|  net/ipv4/netfilter/nf_nat_proto_common.c |    8 ++++++--
>|  2 files changed, 7 insertions(+), 2 deletions(-)
>
>Signed-off-by: Luis Claudio R. Goncalves <lgoncalv@redhat.com>
>
>---
>diff --git a/drivers/char/random.c b/drivers/char/random.c
>index b79830b..b5a2be9 100644
>--- a/drivers/char/random.c
>+++ b/drivers/char/random.c
>@@ -1581,6 +1581,7 @@ u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport)
> 
> 	return half_md4_transform(hash, keyptr->secret);
> }
>+EXPORT_SYMBOL_GPL(secure_ipv4_port_ephemeral);
> 
> #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
> u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr, __be16 dport)
>diff --git a/net/ipv4/netfilter/nf_nat_proto_tcp.c b/net/ipv4/netfilter/nf_nat_proto_tcp.c
>index 6bab2e1..cea8193 100644
>--- a/net/ipv4/netfilter/nf_nat_proto_tcp.c
>+++ b/net/ipv4/netfilter/nf_nat_proto_tcp.c
>@@ -77,7 +77,13 @@ tcp_unique_tuple(struct nf_conntrack_tuple *tuple,
> 	}
> 
> 	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
>-		port =  net_random();
>+		port = secure_ipv4_port_ephemeral(tuple->src.u3.ip,
>+						tuple->dst.u3.ip,
>+						maniptype == IP_NAT_MANIP_SRC
>+						? tuple->dst.u.all
>+						: tuple->src.u.all);
>+	else
>+		port = *portptr;
> 
> 	for (i = 0; i < range_size; i++, port++) {
> 		*portptr = htons(min + port % range_size);
>diff --git a/net/ipv4/netfilter/nf_nat_proto_udp.c b/net/ipv4/netfilter/nf_nat_proto_udp.c
>index cbf1a61..dceacd4 100644
>--- a/net/ipv4/netfilter/nf_nat_proto_udp.c
>+++ b/net/ipv4/netfilter/nf_nat_proto_udp.c
>@@ -75,7 +75,13 @@ udp_unique_tuple(struct nf_conntrack_tuple *tuple,
> 	}
> 
> 	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
>-		port = net_random();
>+		port = secure_ipv4_port_ephemeral(tuple->src.u3.ip,
>+						tuple->dst.u3.ip,
>+						maniptype == IP_NAT_MANIP_SRC
>+						? tuple->dst.u.all
>+						: tuple->src.u.all);
>+	else
>+		port = *portptr;
> 
> 	for (i = 0; i < range_size; i++, port++) {
> 		*portptr = htons(min + port % range_size);

Actions: View | Diff

Attachments on bug 459942: 314889 | 316250