Subject: Re: [PATCH] nf-nat: don't use per destination incrementing ports in nat random mode

From: Daniel Borkmann <[email-masked]>
Date: Fri, 20 Dec 2013 00:21:15 +0100

On 12/19/2013 02:40 PM, Hannes Frederic Sowa wrote:
> Don't use per destination incrementing port allocation
> in NF_NAT_RANGE_PROTO_RANDOM mode as advised in
> <https://sites.google.com/site/hayashulman/files/NIC-derandomisation.pdf>.
>
> This is especially important for UDP/DNS.
>
> Cc: Patrick McHardy <[email-masked]>
> Cc: Daniel Borkmann <[email-masked]>
> Signed-off-by: Hannes Frederic Sowa <[email-masked]>

I would have liked a more elaborate commit message ;) but anyway,
lgtm, now that we also have periodic reseeding in prandom:

Reviewed-by: Daniel Borkmann <[email-masked]>

The referenced paper in section 5 is also available here:

http://arxiv.org/pdf/1205.5190v1.pdf