Florian Westphal
1922476bee
netfilter: ctnetlink: don't use conntrack/expect object addresses as id
...
commit 3c79107631db1f7fd32cf3f7368e4672004a3010 upstream.
else, we leak the addresses to userspace via ctnetlink events
and dumps.
Compute an ID on demand based on the immutable parts of nf_conn struct.
Another advantage compared to using an address is that there is no
immediate re-use of the same ID in case the conntrack entry is freed and
reallocated again immediately.
Fixes: 3583240249 ("[NETFILTER]: nf_conntrack_expect: kill unique ID")
Fixes: 7f85f91472 ("[NETFILTER]: nf_conntrack: kill unique ID")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-08-25 10:51:42 +02:00
..
9p
bluetooth
Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
2019-07-10 09:55:34 +02:00
caif
caif: reduce stack size with KASAN
2019-05-08 07:19:07 +02:00
irda
iucv
s390/iucv: do not use arrays as argument
2015-09-21 16:03:04 -07:00
netfilter
netfilter: ctnetlink: don't use conntrack/expect object addresses as id
2019-08-25 10:51:42 +02:00
netns
inet: switch IP ID generator to siphash
2019-08-25 10:51:42 +02:00
nfc
NFC: Fix the number of pipes
2018-09-29 03:07:30 -07:00
phonet
phonet: fix building with clang
2019-03-23 13:19:44 +01:00
sctp
sctp: get sctphdr by offset in sctp_compute_cksum
2019-04-03 06:24:15 +02:00
tc_act
net/sched: act_tunnel_key: fix NULL dereference when 'goto chain' is used
2018-08-24 13:12:37 +02:00
6lowpan.h
6lowpan: add 802.15.4 short addr slaac
2016-06-15 20:41:22 -07:00
act_api.h
net_sched: convert tcf_exts from list to pointer array
2016-08-17 19:27:51 -04:00
addrconf.h
ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf
2017-05-14 14:00:21 +02:00
af_ieee802154.h
ieee802154: af_ieee802154: fix typo in comment.
2015-09-17 13:20:05 +02:00
af_rxrpc.h
rxrpc: Rewrite the data and ack handling code
2016-09-08 11:10:12 +01:00
af_unix.h
af_unix: split 'u->readlock' into two: 'iolock' and 'bindlock'
2016-09-04 13:29:29 -07:00
af_vsock.h
vsock: split dwork to avoid reinitializations
2018-08-22 07:47:13 +02:00
ah.h
arp.h
ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
2019-06-11 12:22:49 +02:00
atmclip.h
ax25.h
ax25: fix possible use-after-free
2019-02-23 09:05:59 +01:00
ax88796.h
bond_3ad.h
bonding: 3ad: apply ad_actor settings changes immediately
2016-02-09 04:45:49 -05:00
bond_alb.h
bond_options.h
bonding: convert num_grat_arp to the new bonding option API
2015-07-27 01:05:24 -07:00
bonding.h
bonding: avoid possible dead-lock
2018-10-18 09:13:21 +02:00
busy_poll.h
net: un-inline sk_busy_loop()
2015-11-18 16:17:38 -05:00
calipso.h
calipso: Add a label cache.
2016-06-27 15:06:17 -04:00
cfg80211-wext.h
cfg80211.h
cfg80211: make RATE_INFO_BW_20 the default
2018-04-13 19:47:49 +02:00
cfg802154.h
ieee802154: add netns support
2016-07-08 12:20:57 +02:00
checksum.h
csum: Update csum_block_add to use rotate instead of byteswap
2016-03-13 15:01:00 -04:00
cipso_ipv4.h
netlabel: out of bound access in cipso_v4_validate()
2017-02-18 15:11:41 +01:00
cls_cgroup.h
cls_cgroup: get sk_classid only from full sockets
2016-04-19 20:09:25 -04:00
codel.h
codel: split into multiple files
2016-04-25 16:44:27 -04:00
codel_impl.h
codel: split into multiple files
2016-04-25 16:44:27 -04:00
codel_qdisc.h
net_sched: fq_codel: cache skb->truesize into skb->cb
2016-06-25 12:19:35 -04:00
compat.h
packet: compat support for sock_fprog
2016-06-09 23:41:03 -07:00
datalink.h
dcbevent.h
dcbnl.h
devlink.h
devlink: remove unused priv_size
2016-08-26 11:55:18 -07:00
dn.h
dn_dev.h
dn_fib.h
dn_neigh.h
netfilter: Pass net into okfn
2015-09-17 17:18:37 -07:00
dn_nsp.h
dn_route.h
dsa.h
net: dsa: add port fast ageing
2016-09-23 08:38:50 -04:00
dsfield.h
dst.h
ipv4: add reference counting to metrics
2017-06-07 12:07:46 +02:00
dst_cache.h
net: add dst_cache support
2016-02-16 20:21:48 -05:00
dst_metadata.h
net/dst: Utility functions to build dst_metadata without supplying an skb
2016-09-10 20:53:55 -07:00
dst_ops.h
ipv4, ipv6: Pass net into __ip_local_out and __ip6_local_out
2015-10-08 04:27:02 -07:00
esp.h
ethoc.h
net/ethoc: support big-endian register layout
2015-09-23 15:33:15 -07:00
fib_rules.h
net: Add l3mdev rule
2016-06-08 11:36:02 -07:00
firewire.h
flow.h
net: flow: Remove FLOWI_FLAG_L3MDEV_SRC flag
2016-09-10 23:12:53 -07:00
flow_dissector.h
rps: flow_dissector: Add the const for the parameter of flow_keys_have_l4
2016-09-01 16:51:08 -07:00
flowcache.h
fou.h
fou: Add encap ops for IPv6 tunnels
2016-05-20 18:03:16 -04:00
fq.h
fq.h: Port memory limit mechanism from fq_codel
2016-09-30 13:29:21 +02:00
fq_impl.h
fq.h: Port memory limit mechanism from fq_codel
2016-09-30 13:29:21 +02:00
garp.h
gen_stats.h
net: sched: do not acquire qdisc spinlock in qdisc/class stats dump
2016-06-07 16:37:14 -07:00
genetlink.h
Revert "genl: Add genlmsg_new_unicast() for unicast message allocation"
2016-02-18 11:42:19 -05:00
geneve.h
net: Remove deprecated tunnel specific UDP offload functions
2016-06-17 20:23:32 -07:00
gre.h
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2016-08-18 01:17:32 -04:00
gro_cells.h
gro_cells: make sure device is up in gro_cells_receive()
2019-03-19 13:14:10 +01:00
gtp.h
gtp: #define #define _GTP_H_ and not #define _GTP_H
2016-07-25 17:55:43 -07:00
gue.h
hwbm.h
net: add a hardware buffer management helper API
2016-03-14 12:19:46 -04:00
icmp.h
net: Add __icmp_send helper.
2019-03-13 14:04:53 -07:00
ieee80211_radiotap.h
mac80211: add support for radiotap timestamp field
2016-09-12 11:45:45 +02:00
ieee802154_netdev.h
mac802154: constify ieee802154_llsec_ops structure
2016-01-04 20:40:41 +01:00
if_inet6.h
IPv6: fix DESYNC_FACTOR
2016-10-14 10:59:15 -04:00
ila.h
ila: Add generic ILA translation facility
2015-12-15 23:25:20 -05:00
inet6_connection_sock.h
ipv6: remove unused in6_addr struct
2016-03-22 15:45:44 -04:00
inet6_hashtables.h
tcp/dccp: do not touch listener sk_refcnt under synflood
2016-04-04 22:11:20 -04:00
inet_common.h
ip4ip6: Support for GSO/GRO
2016-05-20 18:03:17 -04:00
inet_connection_sock.h
tcp/dccp: drop SYN packets if accept queue is full
2019-03-27 14:13:04 +09:00
inet_ecn.h
ipv6: suppress sparse warnings in IP6_ECN_set_ce()
2016-08-13 15:08:00 -07:00
inet_frag.h
net: IP defrag: encapsulate rbtree defrag code into callable functions
2019-05-02 09:32:06 +02:00
inet_hashtables.h
tcp/dccp: do not touch listener sk_refcnt under synflood
2016-04-04 22:11:20 -04:00
inet_sock.h
inet: make sure to grab rcu_read_lock before using ireq->ireq_opt
2018-10-18 09:13:23 +02:00
inet_timewait_sock.h
soreuseport: initialise timewait reuseport field
2018-05-16 10:08:41 +02:00
inetpeer.h
net: ipv4: use a dedicated counter for icmp_v4 redirect packets
2019-02-23 09:05:59 +01:00
ip.h
vrf: check accept_source_route on the original netdevice
2019-04-17 08:36:45 +02:00
ip6_checksum.h
ipv6: Pass proto to csum_ipv6_magic as __u8 instead of unsigned short
2016-03-13 23:55:13 -04:00
ip6_fib.h
ipv6: fix sparse warning on rt6i_node
2017-09-20 08:19:53 +02:00
ip6_route.h
net: ipv6: Compare lwstate in detecting duplicate nexthops
2017-07-21 07:42:19 +02:00
ip6_tunnel.h
ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
2019-07-21 09:05:57 +02:00
ip_fib.h
net: ipv4: Fix memory leak in network namespace dismantle
2019-01-31 08:12:33 +01:00
ip_tunnels.h
ip_tunnel: add collect_md mode to IPIP tunnel
2016-09-17 10:13:07 -04:00
ip_vs.h
ipvs: update real-server binding of outgoing connections in SIP-pe
2016-06-06 09:47:25 +09:00
ipcomp.h
ipconfig.h
ipv6.h
ipv6: remove dependency of nf_defrag_ipv6 on ipv6 module
2019-05-02 09:32:06 +02:00
ipv6_frag.h
net: IP6 defrag: use rbtrees for IPv6 defrag
2019-05-02 09:32:06 +02:00
ipx.h
iw_handler.h
wext: handle NULL extra data in iwe_stream_add_point better
2017-08-11 08:49:34 -07:00
kcm.h
kcm: Use stream parser
2016-08-17 19:36:23 -04:00
l3mdev.h
ipvlan, l3mdev: fix broken l3s mode wrt local routes
2019-02-06 17:33:27 +01:00
lapb.h
lib80211.h
llc.h
llc: use refcount_inc_not_zero() for llc_sap_find()
2018-08-22 07:47:13 +02:00
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc: properly handle dev_queue_xmit() return value
2018-05-30 07:50:39 +02:00
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
lwtunnel.h
lwtunnel: valid encap attr check should return 0 when lwtunnel is disabled
2017-02-18 15:11:42 +01:00
mac80211.h
mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4
2018-05-30 07:50:28 +02:00
mac802154.h
ieee802154: cleanup WARN_ON for fc fetch
2016-07-08 13:23:12 +02:00
mip6.h
mld.h
mpls.h
openvswitch: use mpls_hdr
2016-10-03 02:00:22 -04:00
mpls_iptunnel.h
mpls: multipath route support
2015-10-23 06:26:42 -07:00
mrp.h
ncsi.h
net/ncsi: Introduce ncsi_stop_dev()
2016-10-04 02:11:51 -04:00
ndisc.h
6lowpan: introduce 6lowpan-nd
2016-06-15 20:41:23 -07:00
neighbour.h
neighbour: Avoid writing before skb->head in neigh_hh_output()
2018-12-17 09:38:31 +01:00
net_namespace.h
netns: provide pure entropy for net_hash_mix()
2019-04-17 08:36:46 +02:00
net_ratelimit.h
netevent.h
neigh: Send a notification when DELAY_PROBE_TIME changes
2016-07-05 09:06:29 -07:00
netlabel.h
netlabel: Implement CALIPSO config functions for SMACK.
2016-06-27 15:06:18 -04:00
netlink.h
netlink: fix nla_put_{u8,u16,u32} for KASAN
2017-10-12 11:51:25 +02:00
netprio_cgroup.h
net: wrap sock->sk_cgrp_prioidx and ->sk_classid inside a struct
2015-12-08 22:02:33 -05:00
netrom.h
nexthop.h
net: fix rtnh_ok()
2018-05-16 10:08:41 +02:00
nl802154.h
ieee802154: add netns support
2016-07-08 12:20:57 +02:00
p8022.h
ping.h
net: ping: make ping_v6_sendmsg static
2016-03-23 22:09:58 -04:00
pkt_cls.h
net/sched: pkt_cls: change tc actions order to be as the user sets
2016-09-28 05:02:44 -04:00
pkt_sched.h
net: sched: convert qdisc linked list to hashtable
2016-08-10 17:19:02 -07:00
pptp.h
pptp: Refactor the struct and macros of PPTP codes
2016-08-15 10:55:53 -07:00
protocol.h
udp: Remove udp_offloads
2016-04-07 16:53:30 -04:00
psnap.h
raw.h
sock: struct proto hash function may error
2016-02-11 03:54:14 -05:00
rawv6.h
red.h
net_sched: red: Avoid illegal values
2018-02-25 11:05:48 +01:00
regulatory.h
regulatory: add NUL to request alpha2
2018-05-30 07:50:30 +02:00
request_sock.h
inet: reqsk_alloc() needs to take care of dead listeners
2016-04-04 22:11:19 -04:00
rose.h
route.h
ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min_pmtu
2018-05-30 07:50:36 +02:00
rtnetlink.h
net: rtnetlink: add support for the IFLA_STATS_LINK_XSTATS_SLAVE attribute
2016-06-30 06:15:04 -04:00
sch_generic.h
sch_netem: fix skb leak in netem_enqueue()
2018-03-31 18:11:33 +02:00
scm.h
unix: correctly track in-flight fds in sending process user_struct
2016-02-08 10:30:42 -05:00
secure_seq.h
slhc_vj.h
slip: Check if rstate is initialized before uncompressing
2018-04-20 08:21:07 +02:00
snmp.h
net: snmp: fix 64bit stats on 32bit arches
2016-04-28 11:49:45 -04:00
sock.h
packets: Always register packet sk in the same order
2019-04-03 06:24:15 +02:00
sock_reuseport.h
soreuseport: fix NULL ptr dereference SO_REUSEPORT after bind
2016-01-19 14:44:23 -05:00
Space.h
stp.h
strparser.h
kcm: Remove TCP specific references from kcm and strparser
2016-08-28 23:32:41 -04:00
switchdev.h
switchdev: remove FIB offload infrastructure
2016-09-28 04:48:00 -04:00
tcp.h
tcp: be more careful in tcp_fragment()
2019-08-11 12:22:14 +02:00
tcp_states.h
timewait_sock.h
inet: remove BUG_ON() in twsk_destructor()
2015-07-09 15:12:20 -07:00
transp_v6.h
ipv6: add new struct ipcm6_cookie
2016-05-03 16:08:14 -04:00
tso.h
net: tso: add support for IPv6
2015-10-26 22:24:22 -07:00
udp.h
udp: must lock the socket in udp_disconnect()
2016-10-20 14:45:52 -04:00
udp_tunnel.h
vxlan: Add new UDP encapsulation offload type for VXLAN-GPE
2016-06-17 20:23:32 -07:00
udplite.h
udplite: fix partial checksum initialization
2018-03-11 16:21:32 +01:00
vsock_addr.h
vxlan.h
vxlan: fix hlist corruption
2017-07-21 07:42:18 +02:00
wext.h
wimax.h
x25.h
net: x25: fix one potential use-after-free issue
2018-04-13 19:48:00 +02:00
x25device.h
xfrm.h
xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
2017-07-05 14:40:28 +02:00