Commit adda60cc authored by Florian Westphal's avatar Florian Westphal
Browse files

netfilter: nat: avoid long-running port range loop 

Looping a large port range takes too long. Instead select a random
offset within [ntohs(exp->saved_proto.tcp.port), 65535] and try 128
ports.

This is a rehash of an erlier patch to do the same, but generalized
to handle other helpers as well.

Link: https://patchwork.ozlabs.org/project/netfilter-devel/patch/20210920204439.13179-2-Cole.Dishington@alliedtelesis.co.nz/


Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent c92c2717

net/netfilter/nf_nat_helper.c

+14 −2
Original line number Diff line number Diff line
@@ -201,8 +201,18 @@ EXPORT_SYMBOL(nf_nat_follow_master); 


u16 nf_nat_exp_find_port(struct nf_conntrack_expect *exp, u16 port)

{

	static const unsigned int max_attempts = 128;

	int range, attempts_left;

	u16 min = port;



	range = USHRT_MAX - port;

	attempts_left = range;



	if (attempts_left > max_attempts)

		attempts_left = max_attempts;



	/* Try to get same port: if not, try to change it. */

	for (; port != 0; port++) {

	for (;;) {

		int res;



		exp->tuple.dst.u.tcp.port = htons(port);
@@ -210,8 +220,10 @@ u16 nf_nat_exp_find_port(struct nf_conntrack_expect *exp, u16 port) 
		if (res == 0)

			return port;



		if (res != -EBUSY)

		if (res != -EBUSY || (--attempts_left < 0))

			break;



		port = min + prandom_u32_max(range);

	}



	return 0;