Kevin Cernekee 0b18782288 netlink: Add netns check on taps ... [ Upstream commit 93c647643b ] Currently, a nlmon link inside a child namespace can observe systemwide netlink activity. Filter the traffic so that nlmon can only sniff netlink messages from its own netns. Test case: vpnns -- bash -c "ip link add nlmon0 type nlmon; \ ip link set nlmon0 up; \ tcpdump -i nlmon0 -q -w /tmp/nlmon.pcap -U" & sudo ip xfrm state add src 10.1.1.1 dst 10.1.1.2 proto esp \ spi 0x1 mode transport \ auth sha1 0x6162633132330000000000000000000000000000 \ enc aes 0x00000000000000000000000000000000 grep --binary abc123 /tmp/nlmon.pcap Signed-off-by: Kevin Cernekee <cernekee@chromium.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-01-02 20:35:10 +01:00
..
Kconfig	netlink: remove mmapped netlink support	2016-02-18 11:42:18 -05:00
Makefile	netlink: Diag core and basic socket info dumping (v2)	2013-03-21 12:38:03 -04:00
af_netlink.c	netlink: Add netns check on taps	2018-01-02 20:35:10 +01:00
af_netlink.h	af_netlink: ensure that NLMSG_DONE never fails in dumps	2017-11-24 08:33:41 +01:00
diag.c	netlink: netlink_diag_dump() runs without locks	2016-11-03 16:16:51 -04:00
genetlink.c	genetlink: fix a memory leak on error path	2016-11-03 16:52:29 -04:00