Re: Resend [Patch 1/2] Avoid direct connections between NATed hosts

[Patrick McHardy <kaber@trash.net>]

Eric Leblond wrote:
>>> 
>>>+	/* Start from random port to avoid prediction */
>>>+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
>>>+		port = (u_int16_t) net_random();
>>
>>No need to cast, also endianness error (port is __be16).


>>>diff --git a/net/ipv4/netfilter/ip_nat_proto_tcp.c b/net/ipv4/netfilter/ip_nat_proto_tcp.c
>>>index b586d18..78ff1bb 100644
>>>--- a/net/ipv4/netfilter/ip_nat_proto_tcp.c
>>>+++ b/net/ipv4/netfilter/ip_nat_proto_tcp.c
>>>@@ -8,6 +8,7 @@
>>> 
>>> #include <linux/types.h>
>>> #include <linux/init.h>
>>>+#include <linux/random.h>
>>> #include <linux/netfilter.h>
>>> #include <linux/ip.h>
>>> #include <linux/tcp.h>
>>>@@ -75,6 +76,9 @@ tcp_unique_tuple(struct ip_conntrack_tup
>>> 		range_size = ntohs(range->max.tcp.port) - min + 1;
>>> 	}
>>> 
>>>+	/* Start from random port to avoid prediction */
>>>+	if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
>>>+		port =  __cpu_to_be16(net_random());


Sorry that was my mistake, port is host endian, I can fix that before
applying. Other than that it looks fine, if there are no objections
from other people I'm going to apply it this weekend.