Re: [PATCH nf] netfilter: conntrack: do not dump other netns's conntrack entries via proc

2016-08-17 Thread Pablo Neira Ayuso 
On Mon, Aug 15, 2016 at 09:50:35PM +0800, Liping Zhang wrote:
> From: Liping Zhang 
> 
> We should skip the conntracks that belong to a different namespace,
> otherwise other unrelated netns's conntrack entries will be dumped via
> /proc/net/nf_conntrack.

Applied to nf, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH nf] netfilter: conntrack: do not dump other netns's conntrack entries via proc

2016-08-15 Thread Florian Westphal 
Liping Zhang  wrote:
> From: Liping Zhang 
> 
> We should skip the conntracks that belong to a different namespace,
> otherwise other unrelated netns's conntrack entries will be dumped via
> /proc/net/nf_conntrack.
> 
> Fixes: 56d52d4892d0 ("netfilter: conntrack: use a single hashtable for all 
> namespaces")
> Signed-off-by: Liping Zhang 

Thanks for the fix.

Reviewed-by: Florian Westphal 
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html