Florian, Am 01.07.2017 um 12:35 schrieb Florian Westphal: >>> Perhaps we can place that in a new extension (its not needed in any >>> fastpath ops)? >> >> To get rid of the infoleak we have to re-introduce the id field in struct nf_conn >> and struct nf_conntrack_expect. > > Why will this not work? You are right, when we compute the ID from the whole object, it should be fine. >> Otherwise have nothing to compare against in the conntrack/expect remove case. > > Not following, sorry. The id is not used anywhere except when we send > info to userspace. > > The compare on removal is not needed afaics, and its also not used when > doing lookup to begin with, so we can just recompute it? Isn't this a way too much overhead? I personally favor Pablo's per-cpu counter approach. That way the IDs are unique again and we get rid of the info leak without much effort. Thanks, //richard -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
