diff options
| author | David S. Miller <davem@davemloft.net> | 2014-01-09 00:04:56 +0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-01-09 00:04:56 +0400 |
| commit | 54b553e2c16001d13e0186cad2531764065f9a1b (patch) | |
| tree | a43c673e5e5aeaa87ba86f334b069453e9374569 /net/netfilter/nfnetlink_log.c | |
| parent | 80077935cad223b292d4a03e901a953b20a36593 (diff) | |
| parent | b22f5126a24b3b2f15448c3f2a254fc10cbc2b92 (diff) | |
| download | linux-54b553e2c16001d13e0186cad2531764065f9a1b.tar.xz | |
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
Pablo Neira Ayuso says:
====================
Netfilter updates for net-next
The following patchset contains three Netfilter updates, they are:
* Fix wrong usage of skb_header_pointer in the DCCP protocol helper that
has been there for quite some time. It was resulting in copying the dccp
header to a pointer allocated in the stack. Fortunately, this pointer
provides room for the dccp header is 4 bytes long, so no crashes have been
reported so far. From Daniel Borkmann.
* Use format string to print in the invocation of nf_log_packet(), again
in the DCCP helper. Also from Daniel Borkmann.
* Revert "netfilter: avoid get_random_bytes call" as prandom32 does not
guarantee enough entropy when being calling this at boot time, that may
happen when reloading the rule.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netfilter/nfnetlink_log.c')
| -rw-r--r-- | net/netfilter/nfnetlink_log.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c index d292c8d286eb..a155d19a225e 100644 --- a/net/netfilter/nfnetlink_log.c +++ b/net/netfilter/nfnetlink_log.c @@ -28,6 +28,8 @@ #include <linux/proc_fs.h> #include <linux/security.h> #include <linux/list.h> +#include <linux/jhash.h> +#include <linux/random.h> #include <linux/slab.h> #include <net/sock.h> #include <net/netfilter/nf_log.h> @@ -73,6 +75,7 @@ struct nfulnl_instance { }; #define INSTANCE_BUCKETS 16 +static unsigned int hash_init; static int nfnl_log_net_id __read_mostly; @@ -1064,6 +1067,11 @@ static int __init nfnetlink_log_init(void) { int status = -ENOMEM; + /* it's not really all that important to have a random value, so + * we can do this from the init function, even if there hasn't + * been that much entropy yet */ + get_random_bytes(&hash_init, sizeof(hash_init)); + netlink_register_notifier(&nfulnl_rtnl_notifier); status = nfnetlink_subsys_register(&nfulnl_subsys); if (status < 0) { |