Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1686041 > unrolled thread

Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Richard Weinberger <richard@nod.at> - 2017-07-12 23:30 +0200
    Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Florian Westphal <fw@strlen.de> - 2017-07-13 00:30 +0200

#1686041 — Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID

Florian,

Am 01.07.2017 um 12:35 schrieb Florian Westphal:
>>> Perhaps we can place that in a new extension (its not needed in any
>>> fastpath ops)?
>>
>> To get rid of the infoleak we have to re-introduce the id field in struct nf_conn
>> and struct nf_conntrack_expect.
> 
> Why will this not work?

You are right, when we compute the ID from the whole object, it should be fine.

>> Otherwise have nothing to compare against in the conntrack/expect remove case.
> 
> Not following, sorry.  The id is not used anywhere except when we send
> info to userspace.
> 
> The compare on removal is not needed afaics, and its also not used when
> doing lookup to begin with, so we can just recompute it?

Isn't this a way too much overhead?

I personally favor Pablo's per-cpu counter approach.
That way the IDs are unique again and we get rid of the info leak without
much effort.

Thanks,
//richard

[toc] | [next] | [standalone]

#1686078

Richard Weinberger <richard@nod.at> wrote:
> Am 01.07.2017 um 12:35 schrieb Florian Westphal:
> > The compare on removal is not needed afaics, and its also not used when
> > doing lookup to begin with, so we can just recompute it?
> 
> Isn't this a way too much overhead?

I don't think so.  This computation only occurs when we dump events
to userspace.

> I personally favor Pablo's per-cpu counter approach.
> That way the IDs are unique again and we get rid of the info leak without
> much effort.

I have not seen these patches so can't really comment.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web