diff options
| author | Patrick McHardy <kaber@trash.net> | 2011-12-23 14:00:13 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2011-12-23 14:36:44 +0100 |
| commit | 4d4e61c6ca683cdc0ea07d39c80cc8d6d478b31e (patch) | |
| tree | 6c7431f3649d5cc7bf726dab880f68d6f8a4728b /net/ipv4 | |
| parent | cbc9f2f4fcd70d5a627558ca9a881fa9391abf69 (diff) | |
| download | talos-op-linux-4d4e61c6ca683cdc0ea07d39c80cc8d6d478b31e.tar.gz talos-op-linux-4d4e61c6ca683cdc0ea07d39c80cc8d6d478b31e.zip | |
netfilter: nf_nat: use hash random for bysource hash
Use nf_conntrack_hash_rnd in NAT bysource hash to avoid hash chain attacks.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv4')
| -rw-r--r-- | net/ipv4/netfilter/nf_nat_core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c index 58ab7a4611dd..76600f8d434b 100644 --- a/net/ipv4/netfilter/nf_nat_core.c +++ b/net/ipv4/netfilter/nf_nat_core.c @@ -57,7 +57,7 @@ hash_by_src(const struct net *net, u16 zone, /* Original src, to ensure we map it consistently if poss. */ hash = jhash_3words((__force u32)tuple->src.u3.ip, (__force u32)tuple->src.u.all ^ zone, - tuple->dst.protonum, 0); + tuple->dst.protonum, nf_conntrack_hash_rnd); return ((u64)hash * net->ipv4.nat_htable_size) >> 32; } |
