Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID
From: Florian Westphal <fw@strlen.de>
Date: 2017-07-12 22:21:07
Also in:
lkml, netfilter-devel
From: Florian Westphal <fw@strlen.de>
Date: 2017-07-12 22:21:07
Also in:
lkml, netfilter-devel
Richard Weinberger [off-list ref] wrote:
Am 01.07.2017 um 12:35 schrieb Florian Westphal:quoted
The compare on removal is not needed afaics, and its also not used when doing lookup to begin with, so we can just recompute it?Isn't this a way too much overhead?
I don't think so. This computation only occurs when we dump events to userspace.
I personally favor Pablo's per-cpu counter approach. That way the IDs are unique again and we get rid of the info leak without much effort.
I have not seen these patches so can't really comment.