Thread (9 messages) 9 messages, 3 authors, 2017-07-12

Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID

From: Florian Westphal <fw@strlen.de>
Date: 2017-07-12 22:21:07
Also in: lkml, netfilter-devel

Richard Weinberger [off-list ref] wrote:
Am 01.07.2017 um 12:35 schrieb Florian Westphal:
quoted
The compare on removal is not needed afaics, and its also not used when
doing lookup to begin with, so we can just recompute it?
Isn't this a way too much overhead?
I don't think so.  This computation only occurs when we dump events
to userspace.
I personally favor Pablo's per-cpu counter approach.
That way the IDs are unique again and we get rid of the info leak without
much effort.
I have not seen these patches so can't really comment.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help