Messages in this thread | | | Subject | Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID | From | Richard Weinberger <> | Date | Wed, 12 Jul 2017 23:26:35 +0200 |
| |
Florian,
Am 01.07.2017 um 12:35 schrieb Florian Westphal: >>> Perhaps we can place that in a new extension (its not needed in any >>> fastpath ops)? >> >> To get rid of the infoleak we have to re-introduce the id field in struct nf_conn >> and struct nf_conntrack_expect. > > Why will this not work?
You are right, when we compute the ID from the whole object, it should be fine.
>> Otherwise have nothing to compare against in the conntrack/expect remove case. > > Not following, sorry. The id is not used anywhere except when we send > info to userspace. > > The compare on removal is not needed afaics, and its also not used when > doing lookup to begin with, so we can just recompute it?
Isn't this a way too much overhead?
I personally favor Pablo's per-cpu counter approach. That way the IDs are unique again and we get rid of the info leak without much effort.
Thanks, //richard
| |