iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: nat: avoid long-running port range loop

Browse Source 
Looping a large port range takes too long. Instead select a random
offset within [ntohs(exp->saved_proto.tcp.port), 65535] and try 128
ports.

This is a rehash of an erlier patch to do the same, but generalized
to handle other helpers as well.

Link: https://patchwork.ozlabs.org/project/netfilter-devel/patch/20210920204439.13179-2-Cole.Dishington@alliedtelesis.co.nz/
Signed-off-by: Florian Westphal <fw@strlen.de>
This commit is contained in:
Florian Westphal 2022-09-06 17:20:36 +02:00
parent c92c271710
commit adda60cc2b
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
net/netfilter/nf_nat_helper.c
View File

@ -201,8 +201,18 @@ EXPORT_SYMBOL(nf_nat_follow_master);
u16 nf_nat_exp_find_port(struct nf_conntrack_expect *exp, u16 port) u16 nf_nat_exp_find_port(struct nf_conntrack_expect *exp, u16 port)
{ {
static const unsigned int max_attempts = 128;
int range, attempts_left;
u16 min = port;
range = USHRT_MAX - port;
attempts_left = range;
if (attempts_left > max_attempts)
attempts_left = max_attempts;
/* Try to get same port: if not, try to change it. */ /* Try to get same port: if not, try to change it. */
for (; port != 0; port++) { for (;;) {
int res; int res;
exp->tuple.dst.u.tcp.port = htons(port); exp->tuple.dst.u.tcp.port = htons(port);
@ -210,8 +220,10 @@ u16 nf_nat_exp_find_port(struct nf_conntrack_expect *exp, u16 port)
if (res == 0) if (res == 0)
return port; return port;
if (res != -EBUSY) if (res != -EBUSY || (--attempts_left < 0))
break; break;
port = min + prandom_u32_max(range);
} }
return 0; return 0;