Re: [PATCH] net: netfilter: Add RFC-7597 Section 5.1 PSID support
From: Florian Westphal <fw@strlen.de>
Date: 2021-07-05 10:40:17
Also in:
lkml, netfilter-devel
Possibly related (same subject, not in this thread)
- 2021-06-30 · Re: [PATCH] net: netfilter: Add RFC-7597 Section 5.1 PSID support · Florian Westphal <fw@strlen.de>
- 2021-06-29 · [PATCH] net: netfilter: Add RFC-7597 Section 5.1 PSID support · Cole Dishington <hidden>
- 2021-04-26 · Re: [PATCH] net: netfilter: Add RFC-7597 Section 5.1 PSID support · Florian Westphal <fw@strlen.de>
- 2021-04-22 · [PATCH] net: netfilter: Add RFC-7597 Section 5.1 PSID support · Cole Dishington <hidden>
Cole Dishington [off-list ref] wrote:
Adds support for masquerading into a smaller subset of ports - defined by the PSID values from RFC-7597 Section 5.1. This is part of the support for MAP-E and Lightweight 4over6, which allows multiple devices to share an IPv4 address by splitting the L4 port / id into ranges. Co-developed-by: Anthony Lineham <redacted> Signed-off-by: Anthony Lineham <redacted> Co-developed-by: Scott Parlane <redacted> Signed-off-by: Scott Parlane <redacted> Signed-off-by: Blair Steven <redacted> Signed-off-by: Cole Dishington <redacted> ---
Just a quick review:
+ /* In this case we are in PSID mode, avoid checking all ranges by computing bitmasks */
+ if (is_psid) {
+ u16 j = ntohs(max->all) - ntohs(min->all) + 1;
+ u16 a = (1 << 16) / ntohs(base->all);This gives crash when base->all is 0. If this is impossible, please add a comment, otherwise this needs a sanity test on the divisor.
quoted hunk ↗ jump to hunk
@@ -55,8 +55,21 @@ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum, newrange.flags = range->flags | NF_NAT_RANGE_MAP_IPS; newrange.min_addr.ip = newsrc; newrange.max_addr.ip = newsrc; - newrange.min_proto = range->min_proto; - newrange.max_proto = range->max_proto; + + if (range->flags & NF_NAT_RANGE_PSID) { + u16 off = prandom_u32(); + u16 base = ntohs(range->base_proto.all); + u16 min = ntohs(range->min_proto.all); + u16 max_off = ((1 << 16) / base) - 1; + + newrange.flags = newrange.flags | NF_NAT_RANGE_PROTO_SPECIFIED; + newrange.min_proto.all = htons(min + base * (off % max_off));
Same here for base and max_off.