[NETFILTER]: NAT: optional source port randomization support

This patch adds support to NAT to randomize source ports.

Signed-off-by: Eric Leblond <[e-mail]>
Signed-off-by: Patrick McHardy <[e-mail]>
Signed-off-by: David S. Miller <[e-mail]>

include/linux/netfilter_ipv4/ip_nat.h

···
 
 #define IP_NAT_RANGE_MAP_IPS 1
 #define IP_NAT_RANGE_PROTO_SPECIFIED 2
+#define IP_NAT_RANGE_PROTO_RANDOM 4 /* add randomness to "port" selection */
 
 /* NAT sequence number modifications */
 struct ip_nat_seq {

include/net/netfilter/nf_nat.h

···
 
 #define IP_NAT_RANGE_MAP_IPS 1
 #define IP_NAT_RANGE_PROTO_SPECIFIED 2
+#define IP_NAT_RANGE_PROTO_RANDOM 4
 
 /* NAT sequence number modifications */
 struct nf_nat_seq {

net/ipv4/netfilter/ip_nat_core.c

···
 	if (maniptype == IP_NAT_MANIP_SRC) {
 		if (find_appropriate_src(orig_tuple, tuple, range)) {
 			DEBUGP("get_unique_tuple: Found current src map\n");
-			if (!ip_nat_used_tuple(tuple, conntrack))
-				return;
+			if (!(range->flags & IP_NAT_RANGE_PROTO_RANDOM))
+				if (!ip_nat_used_tuple(tuple, conntrack))
+					return;
 		}
 	}
 
···
 	   the range to make a unique tuple. */
 
 	proto = ip_nat_proto_find_get(orig_tuple->dst.protonum);
+
+	/* Change protocol info to have some randomization */
+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM) {
+		proto->unique_tuple(tuple, range, maniptype, conntrack);
+		ip_nat_proto_put(proto);
+		return;
+	}
 
 	/* Only bother mapping if it's not already in range and unique */
 	if ((!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)

net/ipv4/netfilter/ip_nat_proto_tcp.c

···
 
 #include <linux/types.h>
 #include <linux/init.h>
+#include <linux/random.h>
 #include <linux/netfilter.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
···
 		min = ntohs(range->min.tcp.port);
 		range_size = ntohs(range->max.tcp.port) - min + 1;
 	}
+
+	/* Start from random port to avoid prediction */
+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
+		port =  net_random();
 
 	for (i = 0; i < range_size; i++, port++) {
 		*portptr = htons(min + port % range_size);

net/ipv4/netfilter/ip_nat_proto_udp.c

···
 
 #include <linux/types.h>
 #include <linux/init.h>
+#include <linux/random.h>
 #include <linux/netfilter.h>
 #include <linux/ip.h>
 #include <linux/udp.h>
···
 		min = ntohs(range->min.udp.port);
 		range_size = ntohs(range->max.udp.port) - min + 1;
 	}
+
+	/* Start from random port to avoid prediction */
+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
+		port = net_random();
 
 	for (i = 0; i < range_size; i++, port++) {
 		*portptr = htons(min + port % range_size);

net/ipv4/netfilter/ip_nat_rule.c

···
 		printk("DNAT: multiple ranges no longer supported\n");
 		return 0;
 	}
+	if (mr->range[0].flags & IP_NAT_RANGE_PROTO_RANDOM) {
+		printk("DNAT: port randomization not supported\n");
+		return 0;
+	}
 	return 1;
 }
 

net/ipv4/netfilter/nf_nat_core.c

···
 	if (maniptype == IP_NAT_MANIP_SRC) {
 		if (find_appropriate_src(orig_tuple, tuple, range)) {
 			DEBUGP("get_unique_tuple: Found current src map\n");
-			if (!nf_nat_used_tuple(tuple, ct))
-				return;
+			if (!(range->flags & IP_NAT_RANGE_PROTO_RANDOM))
+				if (!nf_nat_used_tuple(tuple, ct))
+					return;
 		}
 	}
 
···
 	   the range to make a unique tuple. */
 
 	proto = nf_nat_proto_find_get(orig_tuple->dst.protonum);
+
+	/* Change protocol info to have some randomization */
+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM) {
+		proto->unique_tuple(tuple, range, maniptype, ct);
+		nf_nat_proto_put(proto);
+		return;
+	}
 
 	/* Only bother mapping if it's not already in range and unique */
 	if ((!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED) ||

net/ipv4/netfilter/nf_nat_proto_tcp.c

···
 
 #include <linux/types.h>
 #include <linux/init.h>
+#include <linux/random.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
 
···
 		min = ntohs(range->min.tcp.port);
 		range_size = ntohs(range->max.tcp.port) - min + 1;
 	}
+
+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
+		port =  net_random();
 
 	for (i = 0; i < range_size; i++, port++) {
 		*portptr = htons(min + port % range_size);

net/ipv4/netfilter/nf_nat_proto_udp.c

···
 
 #include <linux/types.h>
 #include <linux/init.h>
+#include <linux/random.h>
 #include <linux/ip.h>
 #include <linux/udp.h>
 
···
 		min = ntohs(range->min.udp.port);
 		range_size = ntohs(range->max.udp.port) - min + 1;
 	}
+
+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
+		port = net_random();
 
 	for (i = 0; i < range_size; i++, port++) {
 		*portptr = htons(min + port % range_size);

net/ipv4/netfilter/nf_nat_rule.c

···
 		printk("DNAT: multiple ranges no longer supported\n");
 		return 0;
 	}
+	if (mr->range[0].flags & IP_NAT_RANGE_PROTO_RANDOM) {
+		printk("DNAT: port randomization not supported\n");
+		return 0;
+	}
 	return 1;
 }