[PATCH 00/12] add namespace support for netfilter protos

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Currently the sysctl of netfilter proto is not isolated, so when 
changing proto's sysctl in container will cause the host's sysctl 
be changed too. it's not expected.

This patch set adds the namespace support for netfilter protos.

impletement four pernet_operations to register sysctl,and disable 
register sysctl when protos are registered.

nf_conntrack_net_proto_ipv4_ops is used to register tcp4(compat),
udp4(compat),icmp(compat),ipv4(compat).
nf_conntrack_net_proto_ipv6_ops is used to register tcp6,udp6 and 
icmpv6.
nf_conntrack_net_proto_sctp_ops is used to register sctp4(compat) 
and sctp6.
nf_conntrack_net_proto_udplite_ops is used to register udplite4
and udplite6

these operations will be registered when module be loaded.

And this will break the cttimeout, because timeout_nlattr_to_obj
function use the orig timeout(such as tcp_timeouts) to set timeouts.

I will fix this in my next patch.

Gao feng (12):
  netfilter: add struct netns_ct_proto to support netfilter namespace
  netfilter: don't register sysctl when register proto
  netfilter: generic proto sysctl support for net namespace
  netfilter: tcp proto sysctl support for net namespace
  netfilter: udp proto sysctl support for net namespace
  netfilter: icmp proto sysctl support for net namespace
  netfilter: icmpv6 proto sysctl support for net
  netfilter: ipv4 sysctl support for net namespace
  netfilter: ipv6 sysctl support for net namespace
  netfilter: sctp proto sysctl support for net namespace
  netfilter: udplite proto sysctl support for net
  netfilter: export necessary function for generic proto

 include/linux/netfilter/nf_conntrack_udp.h     |   10 +
 include/linux/netfilter/nf_conntrack_udplite.h |   10 +
 include/net/netfilter/nf_conntrack_core.h      |    3 +
 include/net/netfilter/nf_conntrack_l3proto.h   |    6 -
 include/net/netfilter/nf_conntrack_l4proto.h   |   38 +++-
 include/net/netns/conntrack.h                  |   37 ++++
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |   96 ++++++++-
 net/ipv4/netfilter/nf_conntrack_proto_icmp.c   |  116 +++++++++-
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |   48 ++++
 net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c |   54 ++++-
 net/netfilter/nf_conntrack_core.c              |    6 +
 net/netfilter/nf_conntrack_proto.c             |  109 ++--------
 net/netfilter/nf_conntrack_proto_generic.c     |   93 ++++++++-
 net/netfilter/nf_conntrack_proto_sctp.c        |  205 +++++++++++++++---
 net/netfilter/nf_conntrack_proto_tcp.c         |  275 ++++++++++++++++++++----
 net/netfilter/nf_conntrack_proto_udp.c         |  160 ++++++++++++--
 net/netfilter/nf_conntrack_proto_udplite.c     |   83 ++++++--
 17 files changed, 1096 insertions(+), 253 deletions(-)
 create mode 100644 include/linux/netfilter/nf_conntrack_udp.h
 create mode 100644 include/linux/netfilter/nf_conntrack_udplite.h

-- 
1.7.7.6

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Kernel Discussion]     [TCP Instrumentation]     [Ethernet Bridging]     [Linux Wireless Networking]     [Linux WPAN Networking]     [Linux Host AP]     [Linux WPAN Networking]     [Linux Bluetooth Networking]     [Linux ATH6KL Networking]     [Linux Networking Users]     [Linux Coverity]     [VLAN]     [Git]     [IETF Annouce]     [Linux Assembly]     [Security]     [Bugtraq]     [Yosemite Information]     [MIPS Linux]     [ARM Linux Kernel]     [ARM Linux]     [Linux Virtualization]     [Linux IDE]     [Linux RAID]     [Linux SCSI]