tree 077774fc7c86b133da97302ea14a9b8a903efcee
parent 587ad3aa4787c00541f39f0343da44caae3dcac8
author Florian Westphal <fw@strlen.de> 1643891575 +0100
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1644340528 +0100

netfilter: nat: limit port clash resolution attempts

commit a504b703bb1da526a01593da0e4be2af9d9f5fa8 upstream.

In case almost or all available ports are taken, clash resolution can
take a very long time, resulting in soft lockup.

This can happen when many to-be-natted hosts connect to same
destination:port (e.g. a proxy) and all connections pass the same SNAT.

Pick a random offset in the acceptable range, then try ever smaller
number of adjacent port numbers, until either the limit is reached or a
useable port was found.  This results in at most 248 attempts
(128 + 64 + 32 + 16 + 8, i.e. 4 restarts with new search offset)
instead of 64000+,

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>