diff options
| author | Darren Reed <darrenr@FreeBSD.org> | 2008-07-24 12:35:05 +0000 |
|---|---|---|
| committer | Darren Reed <darrenr@FreeBSD.org> | 2008-07-24 12:35:05 +0000 |
| commit | 52c7653383c7913b790ec9c8f7ae48213f4b9493 (patch) | |
| tree | fbe3003abde766264fafdbbd7e484eafc5be4ad5 /sys/contrib/ipfilter/netinet/ip_nat.c | |
| parent | 75ec42320df4af879ff4fb54938046e46c4895fd (diff) | |
| download | src-52c7653383c7913b790ec9c8f7ae48213f4b9493.tar.gz src-52c7653383c7913b790ec9c8f7ae48213f4b9493.zip | |
2020447 IPFilter's NAT can undo name server random port selection
Approved by: darrenr
MFC after: 1 week
Security: CERT VU#521769
Notes
Notes:
svn path=/head/; revision=180778
Diffstat (limited to 'sys/contrib/ipfilter/netinet/ip_nat.c')
| -rw-r--r-- | sys/contrib/ipfilter/netinet/ip_nat.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/sys/contrib/ipfilter/netinet/ip_nat.c b/sys/contrib/ipfilter/netinet/ip_nat.c index a6963213a0a5..8b227e0b4b2b 100644 --- a/sys/contrib/ipfilter/netinet/ip_nat.c +++ b/sys/contrib/ipfilter/netinet/ip_nat.c @@ -1678,6 +1678,9 @@ int logtype; if (logtype != 0 && nat_logging != 0) nat_log(nat, logtype); +#if defined(NEED_LOCAL_RAND) && defined(_KERNEL) + ipf_rand_push(nat, sizeof(*nat)); +#endif /* * Take it as a general indication that all the pointers are set if @@ -2029,7 +2032,13 @@ natinfo_t *ni; /* * Standard port translation. Select next port. */ - port = htons(np->in_pnext++); + if (np->in_flags & IPN_SEQUENTIAL) { + port = htons(np->in_pnext); + } else { + port = ipf_random() % (ntohs(np->in_pmax) - + ntohs(np->in_pmin)); + } + np->in_pnext++; if (np->in_pnext > ntohs(np->in_pmax)) { np->in_pnext = ntohs(np->in_pmin); @@ -3793,7 +3802,7 @@ u_32_t *passp; READ_ENTER(&ipf_nat); - if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) && + if (((fin->fin_flx & FI_ICMPERR) != 0) && (nat = nat_icmperror(fin, &nflags, NAT_OUTBOUND))) /*EMPTY*/; else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin))) @@ -4088,7 +4097,7 @@ u_32_t *passp; READ_ENTER(&ipf_nat); - if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) && + if (((fin->fin_flx & FI_ICMPERR) != 0) && (nat = nat_icmperror(fin, &nflags, NAT_INBOUND))) /*EMPTY*/; else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin))) |