Florian Westphal 7b115755fb netfilter: ctnetlink: don't use conntrack/expect object addresses as id ...

[ Upstream commit 3c79107631 ]

else, we leak the addresses to userspace via ctnetlink events
and dumps.

Compute an ID on demand based on the immutable parts of nf_conn struct.

Another advantage compared to using an address is that there is no
immediate re-use of the same ID in case the conntrack entry is freed and
reallocated again immediately.

Fixes: 3583240249 ("[NETFILTER]: nf_conntrack_expect: kill unique ID")
Fixes: 7f85f91472 ("[NETFILTER]: nf_conntrack: kill unique ID")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2019-05-16 19:41:23 +02:00

..

ipv4

netfilter: add missing error handling code for register functions

2018-12-17 09:24:36 +01:00

ipv6

netfilter: add missing error handling code for register functions

2018-12-17 09:24:36 +01:00

br_netfilter.h

netfilter: physdev: relax br_netfilter dependency

2019-04-05 22:33:15 +02:00

nf_conntrack_acct.h

netfilter: introduce nf_conn_acct structure

2013-11-03 21:48:49 +01:00

nf_conntrack_core.h

netfilter: conntrack: remove l3proto abstraction

2018-07-17 15:27:49 +02:00

nf_conntrack_count.h

netfilter: nf_conncount: speculative garbage collection on empty lists

2019-01-22 21:40:29 +01:00

nf_conntrack_ecache.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nf_conntrack_expect.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nf_conntrack_extend.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nf_conntrack_helper.h

netfilter: Remove useless param helper of nf_ct_helper_ext_add

2018-07-18 11:26:42 +02:00

nf_conntrack_l4proto.h

netfilter: remove ifdef around cttimeout in struct nf_conntrack_l4proto

2018-08-07 17:14:19 +02:00

nf_conntrack_labels.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nf_conntrack_seqadj.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nf_conntrack_synproxy.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nf_conntrack_timeout.h

netfilter: nf_tables: rework ct timeout set support

2018-08-29 13:04:38 +02:00

nf_conntrack_timestamp.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nf_conntrack_tuple.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nf_conntrack_zones.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nf_conntrack.h

netfilter: ctnetlink: don't use conntrack/expect object addresses as id

2019-05-16 19:41:23 +02:00

nf_dup_netdev.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nf_flow_table.h

netfilter: nft_flow_offload: fix interaction with vrf slave device

2019-02-27 10:08:54 +01:00

nf_log.h

netfilter: check if the socket netns is correct.

2018-06-28 22:21:32 +09:00

nf_nat_core.h

netfilter: add struct nf_nat_hook and use it

2018-05-23 09:26:07 +02:00

nf_nat_helper.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nf_nat_l3proto.h

netfilter: nf_nat: add nat type hooks to nat core

2018-05-23 09:14:06 +02:00

nf_nat_l4proto.h

netfilter: add NAT support for shifted portmap ranges

2018-04-24 10:29:12 +02:00

nf_nat_redirect.h

netfilter: add NAT support for shifted portmap ranges

2018-04-24 10:29:12 +02:00

nf_nat.h

netfilter: nf_nat: add nat hook register functions to nf_nat

2018-05-23 09:14:05 +02:00

nf_queue.h

netfilter: core: remove synchronize_net call if nfqueue is used

2018-01-08 18:01:06 +01:00

nf_socket.h

netfilter: Decrease code duplication regarding transparent socket option

2018-06-03 00:02:01 +02:00

nf_tables_core.h

netfilter: nf_tables: handle meta/lookup with direct call

2018-07-30 11:52:02 +02:00

nf_tables_ipv4.h

netfilter: nf_tables_inet: don't use multihook infrastructure anymore

2018-01-08 18:01:20 +01:00

nf_tables_ipv6.h

netfilter: nf_tables_inet: don't use multihook infrastructure anymore

2018-01-08 18:01:20 +01:00

nf_tables.h

netfilter: nf_tables: bogus EBUSY when deleting set after flush

2019-05-02 09:58:51 +02:00

nf_tproxy.h

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

2018-07-20 22:28:28 -07:00

nfnetlink_log.h

netfilter: xt_NFLOG: use nf_log_packet instead of nfulnl_log_packet.

2018-04-19 13:02:44 +02:00

nft_fib.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nft_masq.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nft_redir.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nft_reject.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

xt_rateest.h

netfilter: make xt_rateest hash table per net

2018-03-05 23:15:44 +01:00