[lkml]   [2017]   [Jun]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID
Richard Weinberger <> wrote:
> Florian,
> Am 30.06.2017 um 21:35 schrieb Florian Westphal:
> > Richard Weinberger <> wrote:
> >> Hi!
> >>
> >> I noticed that nf_conntrack leaks kernel addresses, it uses the memory address
> >> as identifier used for generating conntrack and expect ids..
> >> Since these ids are also visible to unprivileged users via network namespaces
> >> I suggest reverting these commits:
> >
> > Why not use a hash of the address?
> Would also work. Or xor it with a random number.
> On the other hand, for user space it would be more useful when the conntrack id
> does not repeat that often. That's why I favor the good old counter method.
> Currently the conntrack id is reused very fast.
> e.g. in one of our applications we use the conntack id via NFQUEUE and watch the
> destroy events via conntrack. It happens regularly that a new connection has the
> same id than a different connection we saw some moments before, before we receive
> the destroy event from the conntrack socket.

Perhaps we can place that in a new extension (its not needed in any
fastpath ops)?

 \ /
  Last update: 2017-06-30 23:15    [W:0.049 / U:22.140 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site