From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.3 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA5EAC07E9C for ; Mon, 5 Jul 2021 10:40:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D421B613F3 for ; Mon, 5 Jul 2021 10:40:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231172AbhGEKmw (ORCPT ); Mon, 5 Jul 2021 06:42:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57904 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230474AbhGEKmv (ORCPT ); Mon, 5 Jul 2021 06:42:51 -0400 Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [IPv6:2a0a:51c0:0:12e:520::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 99FB4C061574; Mon, 5 Jul 2021 03:40:14 -0700 (PDT) Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1m0M19-0001Ez-WE; Mon, 05 Jul 2021 12:40:00 +0200 Date: Mon, 5 Jul 2021 12:39:59 +0200 From: Florian Westphal To: Cole Dishington Cc: pablo@netfilter.org, Anthony Lineham , Scott Parlane , Blair Steven , Jozsef Kadlecsik , Florian Westphal , "David S. Miller" , Jakub Kicinski , netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] net: netfilter: Add RFC-7597 Section 5.1 PSID support Message-ID: <20210705103959.GG18022@breakpoint.cc> References: <20210630142049.GC18022@breakpoint.cc> <20210705040856.25191-1-Cole.Dishington@alliedtelesis.co.nz> <20210705040856.25191-3-Cole.Dishington@alliedtelesis.co.nz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210705040856.25191-3-Cole.Dishington@alliedtelesis.co.nz> User-Agent: Mutt/1.10.1 (2018-07-13) Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Cole Dishington wrote: > Adds support for masquerading into a smaller subset of ports - > defined by the PSID values from RFC-7597 Section 5.1. This is part of > the support for MAP-E and Lightweight 4over6, which allows multiple > devices to share an IPv4 address by splitting the L4 port / id into > ranges. > > Co-developed-by: Anthony Lineham > Signed-off-by: Anthony Lineham > Co-developed-by: Scott Parlane > Signed-off-by: Scott Parlane > Signed-off-by: Blair Steven > Signed-off-by: Cole Dishington > --- Just a quick review: > + /* In this case we are in PSID mode, avoid checking all ranges by computing bitmasks */ > + if (is_psid) { > + u16 j = ntohs(max->all) - ntohs(min->all) + 1; > + u16 a = (1 << 16) / ntohs(base->all); This gives crash when base->all is 0. If this is impossible, please add a comment, otherwise this needs a sanity test on the divisor. > @@ -55,8 +55,21 @@ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum, > newrange.flags = range->flags | NF_NAT_RANGE_MAP_IPS; > newrange.min_addr.ip = newsrc; > newrange.max_addr.ip = newsrc; > - newrange.min_proto = range->min_proto; > - newrange.max_proto = range->max_proto; > + > + if (range->flags & NF_NAT_RANGE_PSID) { > + u16 off = prandom_u32(); > + u16 base = ntohs(range->base_proto.all); > + u16 min = ntohs(range->min_proto.all); > + u16 max_off = ((1 << 16) / base) - 1; > + > + newrange.flags = newrange.flags | NF_NAT_RANGE_PROTO_SPECIFIED; > + newrange.min_proto.all = htons(min + base * (off % max_off)); Same here for base and max_off.