Files
linux/include/net
Florian Westphal fdf6491193 netfilter: ctnetlink: make event listener tracking global
pernet tracking doesn't work correctly because other netns might have
set NETLINK_LISTEN_ALL_NSID on its event socket.

In this case its expected that events originating in other net
namespaces are also received.

Making pernet-tracking work while also honoring NETLINK_LISTEN_ALL_NSID
requires much more intrusive changes both in netlink and nfnetlink,
f.e. adding a 'setsockopt' callback that lets nfnetlink know that the
event socket entered (or left) ALL_NSID mode.

Move to global tracking instead: if there is an event socket anywhere
on the system, all net namespaces which have conntrack enabled and
use autobind mode will allocate the ecache extension.

netlink_has_listeners() returns false only if the given group has no
subscribers in any net namespace, the 'net' argument passed to
nfnetlink_has_listeners is only used to derive the protocol (nfnetlink),
it has no other effect.

For proper NETLINK_LISTEN_ALL_NSID-aware pernet tracking of event
listeners a new netlink_has_net_listeners() is also needed.

Fixes: 90d1daa458 ("netfilter: conntrack: add nf_conntrack_events autodetect mode")
Reported-by: Bryce Kahle <bryce.kahle@datadoghq.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2023-02-22 00:28:47 +01:00
..
2022-12-06 07:30:55 +09:00
2021-07-01 13:19:48 -07:00
2022-06-22 12:59:43 +01:00
2022-08-23 10:43:11 +02:00
2022-07-28 22:06:15 -07:00
2022-08-09 22:14:02 -07:00
2022-11-03 15:16:50 +01:00
2021-12-16 07:18:35 -08:00
2021-10-15 11:33:08 +01:00
2021-10-13 09:40:46 -07:00
2021-07-27 13:05:56 +01:00
2022-05-11 12:43:10 +01:00
2022-06-19 10:00:02 +01:00
2022-12-19 17:28:50 -08:00
2021-08-03 13:05:26 +01:00
2022-12-12 15:04:39 -08:00