linux-kernel - netfilter: NAT: do the optimization for getting curr_tuple in function nf_nat_setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 24 Oct 2014 12:01:42 +0800
From:	"billbonaparte" <programme110@...il.com>
To:	"'Pablo Neira Ayuso'" <pablo@...filter.org>,
	"'Patrick McHardy'" <kaber@...sh.net>, <kadlec@...ckhole.kfki.hu>,
	<davem@...emloft.net>
Cc:	"Netfilter Developer Mailing List" <netfilter-devel@...r.kernel.org>,
	<coreteam@...filter.org>, <linux-kernel@...r.kernel.org>
Subject: netfilter: NAT: do the optimization for getting curr_tuple in function nf_nat_setup_info

Hi all:
	In function nf_nat_setup_info, we need to get the current tuple
which is supposed to send to destination. 
    If we haven't done any NAT (SNAT or DNAT) for the tuple, then the
current tuple is equal to original tuple,
    otherwise, we should get current tuple by invoking
nf_ct_invert_tuplepr(curr_tuple, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
    like the existing comment says:
    /* What we've got will look like inverse of reply. Normally
	 * this is what is in the conntrack, except for prior
	 * manipulations (future optimization: if num_manips == 0,
	 * orig_tp = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
	 */
	nf_ct_invert_tuplepr(&curr_tuple, 
			     &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
	
	So, since it is so, why don't we do the optimization for getting
current tuple ?
   
   As mentioned above, if we have not done DNAT for the tuple, then the
current tuple is equal to original tuple. 
   So I add the optimization as following:

+	if (!(ct->status & IPS_DST_NAT))  /* we do the optimization, as
mentioned above */
+		curr_tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+	else 
+		nf_ct_invert_tuplepr(curr_tuple,
 			     &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
	
	the attachment is the detailed diff. 

Download attachment "do the optimization for getting curr_tuple in function nf_nat_setup_info.diff" of type "application/octet-stream" (1607 bytes)