redonkable/alistair23-linux
redonkable/alistair23-linux
1
0
Fork 0
Code Releases Activity

netfilter: avoid get_random_bytes calls

Browse source 
All these users need an initial seed value for jhash, prandom is
perfectly fine.  This avoids draining the entropy pool where
its not strictly required.

nfnetlink_log did not use the random value at all.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2013-12-19 18:25:14 +01:00 committed by Pablo Neira Ayuso
parent 8cf4d6a224
commit a42b99a6e3
6 changed files with 5 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
net/netfilter/nfnetlink_log.c
View file

@ -28,8 +28,6 @@
#include <linux/proc_fs.h> #include <linux/proc_fs.h>
#include <linux/security.h> #include <linux/security.h>
#include <linux/list.h> #include <linux/list.h>
#include <linux/jhash.h>
#include <linux/random.h>
#include <linux/slab.h> #include <linux/slab.h>
#include <net/sock.h> #include <net/sock.h>
#include <net/netfilter/nf_log.h> #include <net/netfilter/nf_log.h>
@ -75,7 +73,6 @@ struct nfulnl_instance {
}; };
#define INSTANCE_BUCKETS 16 #define INSTANCE_BUCKETS 16
static unsigned int hash_init;
static int nfnl_log_net_id __read_mostly; static int nfnl_log_net_id __read_mostly;
@ -1066,11 +1063,6 @@ static int __init nfnetlink_log_init(void)
{ {
int status = -ENOMEM; int status = -ENOMEM;
/* it's not really all that important to have a random value, so
* we can do this from the init function, even if there hasn't
* been that much entropy yet */
get_random_bytes(&hash_init, sizeof(hash_init));
netlink_register_notifier(&nfulnl_rtnl_notifier); netlink_register_notifier(&nfulnl_rtnl_notifier);
status = nfnetlink_subsys_register(&nfulnl_subsys); status = nfnetlink_subsys_register(&nfulnl_subsys);
if (status < 0) { if (status < 0) {

2
net/netfilter/nft_hash.c
View file

@ -164,7 +164,7 @@ static int nft_hash_init(const struct nft_set *set,
unsigned int cnt, i; unsigned int cnt, i;
if (unlikely(!nft_hash_rnd_initted)) { if (unlikely(!nft_hash_rnd_initted)) {
get_random_bytes(&nft_hash_rnd, 4); nft_hash_rnd = prandom_u32();
nft_hash_rnd_initted = true; nft_hash_rnd_initted = true;
} }

2
net/netfilter/xt_RATEEST.c
View file

@ -100,7 +100,7 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
int ret; int ret;
if (unlikely(!rnd_inited)) { if (unlikely(!rnd_inited)) {
get_random_bytes(&jhash_rnd, sizeof(jhash_rnd)); jhash_rnd = prandom_u32();
rnd_inited = true; rnd_inited = true;
} }

2
net/netfilter/xt_connlimit.c
View file

@ -229,7 +229,7 @@ static int connlimit_mt_check(const struct xt_mtchk_param *par)
u_int32_t rand; u_int32_t rand;
do { do {
get_random_bytes(&rand, sizeof(rand)); rand = prandom_u32();
} while (!rand); } while (!rand);
cmpxchg(&connlimit_rnd, 0, rand); cmpxchg(&connlimit_rnd, 0, rand);
} }

2
net/netfilter/xt_hashlimit.c
View file

@ -177,7 +177,7 @@ dsthash_alloc_init(struct xt_hashlimit_htable *ht,
/* initialize hash with random val at the time we allocate /* initialize hash with random val at the time we allocate
* the first hashtable entry */ * the first hashtable entry */
if (unlikely(!ht->rnd_initialized)) { if (unlikely(!ht->rnd_initialized)) {
get_random_bytes(&ht->rnd, sizeof(ht->rnd)); ht->rnd = prandom_u32();
ht->rnd_initialized = true; ht->rnd_initialized = true;
} }

2
net/netfilter/xt_recent.c
View file

@ -334,7 +334,7 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
size_t sz; size_t sz;
if (unlikely(!hash_rnd_inited)) { if (unlikely(!hash_rnd_inited)) {
get_random_bytes(&hash_rnd, sizeof(hash_rnd)); hash_rnd = prandom_u32();
hash_rnd_inited = true; hash_rnd_inited = true;
} }
if (info->check_set & ~XT_RECENT_VALID_FLAGS) { if (info->check_set & ~XT_RECENT_VALID_FLAGS) {