[PATCH] Ephemeral port randomization
Taken from FreeBSD, commit log from silby@:
Switch from using sequential to random ephemeral port allocation,
implementation taken directly from OpenBSD.
I've resisted committing this for quite some time because of concern over
TIME_WAIT recycling breakage (sequential allocation ensures that there is a
long time before ports are recycled), but recent testing has shown me that
my fears were unwarranted.
The original OpenBSD code referenced above has been simplified in
FreeBSD, reduced to a few lines. A sysctl has also been added to
disable randomization.
Index: sys/netinet/in_pcb.c
===================================================================
RCS file: /cvs/dcvs/src/sys/netinet/in_pcb.c,v
retrieving revision 1.17
diff -u -r1.17 in_pcb.c
--- sys/netinet/in_pcb.c 10 Apr 2004 00:10:42 -0000 1.17
+++ sys/netinet/in_pcb.c 25 Apr 2004 18:57:08 -0000
@@ -99,6 +99,9 @@
int ipport_hifirstauto = IPPORT_HIFIRSTAUTO; /* 49152 */
int ipport_hilastauto = IPPORT_HILASTAUTO; /* 65535 */
+/* Shall we allocate ephemeral ports in random order? */
+int ipport_randomized = 1;
+
static __inline void
RANGECHK(int var, int min, int max)
{
@@ -141,6 +144,8 @@
&ipport_hifirstauto, 0, &sysctl_net_ipport_check, "I", "");
SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hilast, CTLTYPE_INT|CTLFLAG_RW,
&ipport_hilastauto, 0, &sysctl_net_ipport_check, "I", "");
+SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, randomized, CTLFLAG_RW,
+ &ipport_randomized, 0, "");
/*
* in_pcb.c: manage the Protocol Control Blocks.
@@ -324,6 +329,9 @@
/*
* counting down
*/
+ if (ipport_randomized)
+ *lastport = first -
+ (arc4random() % (first - last));
count = first - last;
do {
@@ -341,6 +349,9 @@
/*
* counting up
*/
+ if (ipport_randomized)
+ *lastport = first +
+ (arc4random() % (last - first));
count = last - first;
do {
Index: share/man/man4/ip.4
===================================================================
RCS file: /cvs/dcvs/src/share/man/man4/ip.4,v
retrieving revision 1.2
diff -u -r1.2 ip.4
--- share/man/man4/ip.4 17 Jun 2003 04:36:59 -0000 1.2
+++ share/man/man4/ip.4 25 Apr 2004 19:06:41 -0000
@@ -175,6 +175,13 @@
and
.Sy net.inet.ip.portrange.lowlast .
.El
+.Pp
+Ports are allocated randomly within the specified port range in order
+to increase the difficulty of random spoofing attacks. In scenarios
+such as benchmarking, this behavior may be undesireable. In these
+cases,
+.Va net.inet.ip.portrange.randomized
+can be used to disable randomization.
.Ss "Multicast Options"
.Pp
.Tn IP
--
Skip
討論串 (同標題文章)
完整討論串 (本文為第 1 之 3 篇)：