Skip to content

Commit 7fe568c

Browse files
c-poc-po
committedMay 22, 2024·
nat: T6345: source NAT port mapping "fully-random" is superfluous in Kernel >=5.0
random - In kernel 5.0 and newer this is the same as fully-random. In earlier kernels the port mapping will be randomized using a seeded MD5 hash mix using source and destination address and destination port. https://git.netfilter.org/nftables/commit/?id=fbe27464dee4588d906492749251454
1 parent 252ae4b commit 7fe568c

File tree

5 files changed

+406
-7
lines changed

5 files changed

+406
-7
lines changed
 

‎interface-definitions/include/nat-translation-options.xml.i

+2-6
Original file line numberDiff line numberDiff line change
@@ -28,22 +28,18 @@
2828
<properties>
2929
<help>Port mapping options</help>
3030
<completionHelp>
31-
<list>random fully-random none</list>
31+
<list>random none</list>
3232
</completionHelp>
3333
<valueHelp>
3434
<format>random</format>
3535
<description>Randomize source port mapping</description>
3636
</valueHelp>
37-
<valueHelp>
38-
<format>fully-random</format>
39-
<description>Full port randomization</description>
40-
</valueHelp>
4137
<valueHelp>
4238
<format>none</format>
4339
<description>Do not apply port randomization</description>
4440
</valueHelp>
4541
<constraint>
46-
<regex>(random|fully-random|none)</regex>
42+
<regex>(random|none)</regex>
4743
</constraint>
4844
</properties>
4945
<defaultValue>none</defaultValue>

‎interface-definitions/include/version/nat-version.xml.i

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
<!-- include start from include/version/nat-version.xml.i -->
2-
<syntaxVersion component='nat' version='7'></syntaxVersion>
2+
<syntaxVersion component='nat' version='8'></syntaxVersion>
33
<!-- include end -->

‎smoketest/config-tests/nat-basic

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
set interfaces ethernet eth0 offload rps
2+
set interfaces ethernet eth0 disable
3+
set interfaces ethernet eth1 offload gro
4+
set interfaces ethernet eth1 offload gso
5+
set interfaces ethernet eth1 offload rps
6+
set interfaces ethernet eth1 offload sg
7+
set interfaces ethernet eth1 offload tso
8+
set interfaces ethernet eth2 offload gro
9+
set interfaces ethernet eth2 offload gso
10+
set interfaces ethernet eth2 offload rps
11+
set interfaces ethernet eth2 offload sg
12+
set interfaces ethernet eth2 offload tso
13+
set interfaces ethernet eth3 offload gro
14+
set interfaces ethernet eth3 offload gso
15+
set interfaces ethernet eth3 offload rps
16+
set interfaces ethernet eth3 offload sg
17+
set interfaces ethernet eth3 offload tso
18+
set interfaces bonding bond10 hash-policy 'layer3+4'
19+
set interfaces bonding bond10 member interface 'eth2'
20+
set interfaces bonding bond10 member interface 'eth3'
21+
set interfaces bonding bond10 mode '802.3ad'
22+
set interfaces bonding bond10 vif 50 address '192.168.189.1/24'
23+
set interfaces loopback lo
24+
set interfaces pppoe pppoe7 authentication password 'vyos'
25+
set interfaces pppoe pppoe7 authentication username 'vyos'
26+
set interfaces pppoe pppoe7 dhcpv6-options pd 0 interface bond10.50 address '1'
27+
set interfaces pppoe pppoe7 dhcpv6-options pd 0 length '56'
28+
set interfaces pppoe pppoe7 ip adjust-mss '1452'
29+
set interfaces pppoe pppoe7 ipv6 address autoconf
30+
set interfaces pppoe pppoe7 ipv6 adjust-mss '1432'
31+
set interfaces pppoe pppoe7 mtu '1492'
32+
set interfaces pppoe pppoe7 no-peer-dns
33+
set interfaces pppoe pppoe7 source-interface 'eth1'
34+
set service lldp interface eth1 disable
35+
set service ntp allow-client address '192.168.189.0/24'
36+
set service ntp server time1.vyos.net
37+
set service ntp server time2.vyos.net
38+
set service ntp listen-address '192.168.189.1'
39+
set service ssh dynamic-protection
40+
set service dhcp-server shared-network-name LAN subnet 192.168.189.0/24 lease '604800'
41+
set service dhcp-server shared-network-name LAN subnet 192.168.189.0/24 option default-router '192.168.189.1'
42+
set service dhcp-server shared-network-name LAN subnet 192.168.189.0/24 option domain-name 'vyos.net'
43+
set service dhcp-server shared-network-name LAN subnet 192.168.189.0/24 option name-server '1.1.1.1'
44+
set service dhcp-server shared-network-name LAN subnet 192.168.189.0/24 option name-server '9.9.9.9'
45+
set service dhcp-server shared-network-name LAN subnet 192.168.189.0/24 range 0 start '192.168.189.20'
46+
set service dhcp-server shared-network-name LAN subnet 192.168.189.0/24 range 0 stop '192.168.189.254'
47+
set service dhcp-server shared-network-name LAN subnet 192.168.189.0/24 subnet-id '1'
48+
set service router-advert interface bond10.50 prefix ::/64 preferred-lifetime '2700'
49+
set service router-advert interface bond10.50 prefix ::/64 valid-lifetime '5400'
50+
set system config-management commit-revisions '100'
51+
set system domain-name 'vyos.net'
52+
set system host-name 'R1'
53+
set system login user vyos authentication encrypted-password '$6$2Ta6TWHd/U$NmrX0x9kexCimeOcYK1MfhMpITF9ELxHcaBU/znBq.X2ukQOj61fVI2UYP/xBzP4QtiTcdkgs7WOQMHWsRymO/'
54+
set system login user vyos authentication plaintext-password ''
55+
set system name-server '1.1.1.1'
56+
set system name-server '9.9.9.9'
57+
set system console device ttyS0 speed '115200'
58+
set nat destination rule 1000 destination port '3389'
59+
set nat destination rule 1000 inbound-interface name 'pppoe7'
60+
set nat destination rule 1000 protocol 'tcp'
61+
set nat destination rule 1000 translation address '192.168.189.5'
62+
set nat destination rule 1000 translation port '3389'
63+
set nat destination rule 10022 destination port '10022'
64+
set nat destination rule 10022 inbound-interface name 'pppoe7'
65+
set nat destination rule 10022 protocol 'tcp'
66+
set nat destination rule 10022 translation address '192.168.189.2'
67+
set nat destination rule 10022 translation port '22'
68+
set nat destination rule 10300 destination port '10300'
69+
set nat destination rule 10300 inbound-interface name 'pppoe7'
70+
set nat destination rule 10300 protocol 'udp'
71+
set nat destination rule 10300 translation address '192.168.189.2'
72+
set nat destination rule 10300 translation port '10300'
73+
set nat source rule 10 outbound-interface name 'eth1'
74+
set nat source rule 10 source address '192.168.189.0/24'
75+
set nat source rule 10 translation address 'masquerade'
76+
set nat source rule 10 translation options port-mapping 'random'
77+
set nat source rule 50 outbound-interface name 'pppoe7'
78+
set nat source rule 50 protocol 'udp'
79+
set nat source rule 50 source address '192.168.189.2'
80+
set nat source rule 50 source port '10300'
81+
set nat source rule 50 translation address 'masquerade'
82+
set nat source rule 50 translation port '10300'
83+
set nat source rule 100 outbound-interface name 'pppoe7'
84+
set nat source rule 100 source address '192.168.189.0/24'
85+
set nat source rule 100 translation address 'masquerade'

‎smoketest/configs/nat-basic

+256
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,256 @@
1+
interfaces {
2+
bonding bond10 {
3+
hash-policy "layer3+4"
4+
member {
5+
interface "eth2"
6+
interface "eth3"
7+
}
8+
mode "802.3ad"
9+
vif 50 {
10+
address "192.168.189.1/24"
11+
}
12+
}
13+
ethernet eth0 {
14+
disable
15+
offload {
16+
gro
17+
gso
18+
rps
19+
sg
20+
tso
21+
}
22+
}
23+
ethernet eth1 {
24+
offload {
25+
gro
26+
gso
27+
rps
28+
sg
29+
tso
30+
}
31+
}
32+
ethernet eth2 {
33+
offload {
34+
gro
35+
gso
36+
rps
37+
sg
38+
tso
39+
}
40+
}
41+
ethernet eth3 {
42+
offload {
43+
gro
44+
gso
45+
rps
46+
sg
47+
tso
48+
}
49+
}
50+
loopback lo {
51+
}
52+
pppoe pppoe7 {
53+
authentication {
54+
password "vyos"
55+
username "vyos"
56+
}
57+
dhcpv6-options {
58+
pd 0 {
59+
interface bond10.50 {
60+
address "1"
61+
}
62+
length "56"
63+
}
64+
}
65+
ip {
66+
adjust-mss "1452"
67+
}
68+
ipv6 {
69+
address {
70+
autoconf
71+
}
72+
adjust-mss "1432"
73+
}
74+
mtu "1492"
75+
no-peer-dns
76+
source-interface "eth1"
77+
}
78+
}
79+
nat {
80+
destination {
81+
rule 1000 {
82+
destination {
83+
port "3389"
84+
}
85+
inbound-interface {
86+
name "pppoe7"
87+
}
88+
protocol "tcp"
89+
translation {
90+
address "192.168.189.5"
91+
port "3389"
92+
}
93+
}
94+
rule 10022 {
95+
destination {
96+
port "10022"
97+
}
98+
inbound-interface {
99+
name "pppoe7"
100+
}
101+
protocol "tcp"
102+
translation {
103+
address "192.168.189.2"
104+
port "22"
105+
}
106+
}
107+
rule 10300 {
108+
destination {
109+
port "10300"
110+
}
111+
inbound-interface {
112+
name "pppoe7"
113+
}
114+
protocol "udp"
115+
translation {
116+
address "192.168.189.2"
117+
port "10300"
118+
}
119+
}
120+
}
121+
source {
122+
rule 10 {
123+
outbound-interface {
124+
name "eth1"
125+
}
126+
source {
127+
address "192.168.189.0/24"
128+
}
129+
translation {
130+
address "masquerade"
131+
options {
132+
port-mapping fully-random
133+
}
134+
}
135+
}
136+
rule 50 {
137+
outbound-interface {
138+
name "pppoe7"
139+
}
140+
protocol "udp"
141+
source {
142+
address "192.168.189.2"
143+
port "10300"
144+
}
145+
translation {
146+
address "masquerade"
147+
port "10300"
148+
}
149+
}
150+
rule 100 {
151+
outbound-interface {
152+
name "pppoe7"
153+
}
154+
source {
155+
address "192.168.189.0/24"
156+
}
157+
translation {
158+
address "masquerade"
159+
}
160+
}
161+
}
162+
}
163+
service {
164+
dhcp-server {
165+
shared-network-name LAN {
166+
subnet 192.168.189.0/24 {
167+
default-router "192.168.189.1"
168+
domain-name "vyos.net"
169+
lease "604800"
170+
name-server "1.1.1.1"
171+
name-server "9.9.9.9"
172+
range 0 {
173+
start "192.168.189.20"
174+
stop "192.168.189.254"
175+
}
176+
}
177+
}
178+
}
179+
lldp {
180+
interface all {
181+
}
182+
interface eth1 {
183+
disable
184+
}
185+
}
186+
ntp {
187+
allow-client {
188+
address "192.168.189.0/24"
189+
}
190+
listen-address "192.168.189.1"
191+
server time1.vyos.net {
192+
}
193+
server time2.vyos.net {
194+
}
195+
}
196+
router-advert {
197+
interface bond10.50 {
198+
prefix ::/64 {
199+
preferred-lifetime "2700"
200+
valid-lifetime "5400"
201+
}
202+
}
203+
}
204+
ssh {
205+
disable-host-validation
206+
dynamic-protection {
207+
}
208+
}
209+
}
210+
system {
211+
config-management {
212+
commit-revisions "100"
213+
}
214+
conntrack {
215+
modules {
216+
ftp
217+
h323
218+
nfs
219+
pptp
220+
sip
221+
sqlnet
222+
tftp
223+
}
224+
}
225+
console {
226+
device ttyS0 {
227+
speed "115200"
228+
}
229+
}
230+
domain-name "vyos.net"
231+
host-name "R1"
232+
login {
233+
user vyos {
234+
authentication {
235+
encrypted-password $6$2Ta6TWHd/U$NmrX0x9kexCimeOcYK1MfhMpITF9ELxHcaBU/znBq.X2ukQOj61fVI2UYP/xBzP4QtiTcdkgs7WOQMHWsRymO/
236+
plaintext-password ""
237+
}
238+
}
239+
}
240+
name-server "1.1.1.1"
241+
name-server "9.9.9.9"
242+
syslog {
243+
global {
244+
facility all {
245+
level "info"
246+
}
247+
facility local7 {
248+
level "debug"
249+
}
250+
}
251+
}
252+
}
253+
254+
// Warning: Do not remove the following line.
255+
// vyos-config-version: "bgp@5:broadcast-relay@1:cluster@2:config-management@1:conntrack@5:conntrack-sync@2:container@2:dhcp-relay@2:dhcp-server@8:dhcpv6-server@1:dns-dynamic@4:dns-forwarding@4:firewall@15:flow-accounting@1:https@6:ids@1:interfaces@32:ipoe-server@3:ipsec@13:isis@3:l2tp@9:lldp@2:mdns@1:monitoring@1:nat@7:nat66@3:ntp@3:openconnect@3:ospf@2:pim@1:policy@8:pppoe-server@10:pptp@5:qos@2:quagga@11:rip@1:rpki@2:salt@1:snmp@3:ssh@2:sstp@6:system@27:vrf@3:vrrp@4:vyos-accel-ppp@2:wanloadbalance@3:webproxy@2"
256+
// Release version: 1.4.0-epa3

‎src/migration-scripts/nat/7-to-8

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
#!/usr/bin/env python3
2+
#
3+
# Copyright (C) 2024 VyOS maintainers and contributors
4+
#
5+
# This program is free software; you can redistribute it and/or modify
6+
# it under the terms of the GNU General Public License version 2 or later as
7+
# published by the Free Software Foundation.
8+
#
9+
# This program is distributed in the hope that it will be useful,
10+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
11+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12+
# GNU General Public License for more details.
13+
#
14+
# You should have received a copy of the GNU General Public License
15+
# along with this program. If not, see <http://www.gnu.org/licenses/>.
16+
17+
# T6345: random - In kernel 5.0 and newer this is the same as fully-random.
18+
# In earlier kernels the port mapping will be randomized using a seeded
19+
# MD5 hash mix using source and destination address and destination port.
20+
# drop fully-random from CLI
21+
22+
from sys import argv,exit
23+
from vyos.configtree import ConfigTree
24+
25+
if len(argv) < 2:
26+
print("Must specify file name!")
27+
exit(1)
28+
29+
file_name = argv[1]
30+
31+
with open(file_name, 'r') as f:
32+
config_file = f.read()
33+
34+
config = ConfigTree(config_file)
35+
36+
if not config.exists(['nat']):
37+
# Nothing to do
38+
exit(0)
39+
40+
for direction in ['source', 'destination']:
41+
# If a node doesn't exist, we obviously have nothing to do.
42+
if not config.exists(['nat', direction]):
43+
continue
44+
45+
# However, we also need to handle the case when a 'source' or 'destination' sub-node does exist,
46+
# but there are no rules under it.
47+
if not config.list_nodes(['nat', direction]):
48+
continue
49+
50+
for rule in config.list_nodes(['nat', direction, 'rule']):
51+
port_mapping = ['nat', direction, 'rule', rule, 'translation', 'options', 'port-mapping']
52+
if config.exists(port_mapping):
53+
tmp = config.return_value(port_mapping)
54+
if tmp == 'fully-random':
55+
config.set(port_mapping, value='random')
56+
57+
try:
58+
with open(file_name, 'w') as f:
59+
f.write(config.to_string())
60+
except OSError as e:
61+
print(f'Failed to save the modified config: {e}')
62+
exit(1)

0 commit comments

Comments
 (0)
Please sign in to comment.