Ephemeral Port Selection

 


IPFlowPortHashDP() #

Ephemeral ports within the rnat (and the slb) module are selected with the IPFlowPortHashDP() function which is an application of the f2568() tabular hashing function.

Per default it returns an ephermeral port within the ephemeral port range 49152-65535 (RFC 6335 and IANA), where the lower bound may be modified with the ephemeralstart parameter when needed.

Selecting an ephemeral port with IPFlowPortHashDP() makes the synchronization of NAT states between VRRP master and backup unnecessary.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

uint16_t IPFlowPortHashDP(struct in6_addr inside_ip,
                        uint16_t inside_port, uint16_t proto, struct in6_addr outside_ip,
                        struct in6_addr destination_ip, uint16_t destination_port) {

  uint64_t f2568_hash;
  uint64_t f2568_hash_net;

  uint16_t inside_port_net = htons(inside_port);
  uint16_t proto_net = htons(proto);
  uint16_t destination_port_net = htons(destination_port);

  uint32_t h_net;
  uint32_t h;

  uint16_t rc;

  f2568_hash = f2568((uint8_t *)&inside_ip, sizeof(inside_ip));
  f2568_hash = f2568resume((uint8_t *)&inside_port_net, sizeof(inside_port_net), 0, f2568_hash);
  f2568_hash = f2568resume((uint8_t *)&proto_net, sizeof(proto_net), 0, f2568_hash); 
  f2568_hash = f2568resume((uint8_t *)&outside_ip, sizeof(outside_ip), 0, f2568_hash);

  f2568_hash = f2568resume((uint8_t *)&destination_ip, sizeof(destination_ip), 0, f2568_hash);
  f2568_hash =
      f2568resume((uint8_t *)&destination_port_net, sizeof(destination_port_net), 0, f2568_hash);

  f2568_hash_net = htonll(f2568_hash);
  memcpy((uint8_t *)&h_net, (uint8_t *)&f2568_hash_net, sizeof(h_net));

  h = ntohl(h_net);

  rc = (h % (IPFLOW_EPHEMERAL_END - PARA_EPHEMERALSTART)) + PARA_EPHEMERALSTART;

  return (rc);
}