Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e77e6ff5 authored by Liping Zhang's avatar Liping Zhang Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: do not dump other netns's conntrack entries via proc 



We should skip the conntracks that belong to a different namespace,
otherwise other unrelated netns's conntrack entries will be dumped via
/proc/net/nf_conntrack.

Fixes: 56d52d48 ("netfilter: conntrack: use a single hashtable for all namespaces")
Signed-off-by: default avatarLiping Zhang <liping.zhang@spreadtrum.com>
Reviewed-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent a1560dd7

net/netfilter/nf_conntrack_standalone.c

+4 −0
Original line number Diff line number Diff line
@@ -205,6 +205,7 @@ static int ct_seq_show(struct seq_file *s, void *v) 
	struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);

	const struct nf_conntrack_l3proto *l3proto;

	const struct nf_conntrack_l4proto *l4proto;

	struct net *net = seq_file_net(s);

	int ret = 0;



	NF_CT_ASSERT(ct);
@@ -215,6 +216,9 @@ static int ct_seq_show(struct seq_file *s, void *v) 
	if (NF_CT_DIRECTION(hash))

		goto release;



	if (!net_eq(nf_ct_net(ct), net))

		goto release;



	l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));

	NF_CT_ASSERT(l3proto);

	l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));