Re: [PATCH nf] netfilter: nat: force port remap to prevent shadowing well-known ports

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Nov 29, 2021 at 03:42:18PM +0100, Florian Westphal wrote:
> If destination port is above 32k and source port below 16k
> assume this might cause 'port shadowing' where a 'new' inbound
> connection matches an existing one, e.g.

How did you arrive at 16k?

> 
> inbound X:41234 -> Y:53 matches existing conntrack entry
>         Z:53 -> X:4123, where Z got natted to X.
> 
> In this case, new packet is natted to Z:53 which is likely
> unwanted.
> 
> We could avoid the rewrite for connections that are not being forwarded,
> but get_unique_tuple() and the callers don't propagate the required hook
> information for this.
> 
> Also adjust test case.
> 
> Cc: Eric Garver <eric@xxxxxxxxxxx>
> Cc: Phil Sutter <phil@xxxxxx>
> Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
> ---

[..]




[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux