Richard Weinberger <richard@xxxxxx> wrote: > Florian, > > Am 30.06.2017 um 21:35 schrieb Florian Westphal: > > Richard Weinberger <richard@xxxxxx> wrote: > >> Hi! > >> > >> I noticed that nf_conntrack leaks kernel addresses, it uses the memory address > >> as identifier used for generating conntrack and expect ids.. > >> Since these ids are also visible to unprivileged users via network namespaces > >> I suggest reverting these commits: > > > > Why not use a hash of the address? > > Would also work. Or xor it with a random number. > > On the other hand, for user space it would be more useful when the conntrack id > does not repeat that often. That's why I favor the good old counter method. > Currently the conntrack id is reused very fast. > e.g. in one of our applications we use the conntack id via NFQUEUE and watch the > destroy events via conntrack. It happens regularly that a new connection has the > same id than a different connection we saw some moments before, before we receive > the destroy event from the conntrack socket. Perhaps we can place that in a new extension (its not needed in any fastpath ops)? -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
