tree 3d2b001949cbd5db8118b0ee8ea1d1db62b84de5
parent 4e1994ef63657da08709640eada7b4c727818a1a
author Florian Westphal <fw@strlen.de> 1554116934 +0200
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1558028483 +0200

netfilter: ctnetlink: don't use conntrack/expect object addresses as id

[ Upstream commit 3c79107631db1f7fd32cf3f7368e4672004a3010 ]

else, we leak the addresses to userspace via ctnetlink events
and dumps.

Compute an ID on demand based on the immutable parts of nf_conn struct.

Another advantage compared to using an address is that there is no
immediate re-use of the same ID in case the conntrack entry is freed and
reallocated again immediately.

Fixes: 3583240249ef ("[NETFILTER]: nf_conntrack_expect: kill unique ID")
Fixes: 7f85f914721f ("[NETFILTER]: nf_conntrack: kill unique ID")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>