Florian Westphal f862c13c3c netfilter: ctnetlink: don't use conntrack/expect object addresses as id
[ Upstream commit 3c79107631db1f7fd32cf3f7368e4672004a3010 ]

else, we leak the addresses to userspace via ctnetlink events
and dumps.

Compute an ID on demand based on the immutable parts of nf_conn struct.

Another advantage compared to using an address is that there is no
immediate re-use of the same ID in case the conntrack entry is freed and
reallocated again immediately.

Fixes: 3583240249ef ("[NETFILTER]: nf_conntrack_expect: kill unique ID")
Fixes: 7f85f914721f ("[NETFILTER]: nf_conntrack: kill unique ID")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-05-16 19:42:23 +02:00
..
2019-02-23 09:06:44 +01:00
2019-05-08 07:20:45 +02:00
2018-12-01 09:42:51 +01:00
2019-02-06 17:31:32 +01:00
2019-03-23 14:35:16 +01:00
2019-05-02 09:40:33 +02:00
2019-05-08 07:20:44 +02:00
2019-03-19 13:13:23 +01:00
2019-01-09 17:14:46 +01:00