From patchwork Thu Feb 7 07:49:44 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gao feng X-Patchwork-Id: 218835 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id BE3DE2C0291 for ; Thu, 7 Feb 2013 18:49:37 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752309Ab3BGHtd (ORCPT ); Thu, 7 Feb 2013 02:49:33 -0500 Received: from cn.fujitsu.com ([222.73.24.84]:1611 "EHLO song.cn.fujitsu.com" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1752328Ab3BGHt3 (ORCPT ); Thu, 7 Feb 2013 02:49:29 -0500 X-IronPort-AV: E=Sophos;i="4.84,620,1355068800"; d="scan'208";a="6699879" Received: from unknown (HELO tang.cn.fujitsu.com) ([10.167.250.3]) by song.cn.fujitsu.com with ESMTP; 07 Feb 2013 15:47:12 +0800 Received: from fnstmail02.fnst.cn.fujitsu.com (tang.cn.fujitsu.com [127.0.0.1]) by tang.cn.fujitsu.com (8.14.3/8.13.1) with ESMTP id r177nO4n018778; Thu, 7 Feb 2013 15:49:25 +0800 Received: from Donkey.fnst.cn.fujitsu.com ([10.167.225.206]) by fnstmail02.fnst.cn.fujitsu.com (Lotus Domino Release 8.5.3) with ESMTP id 2013020715480529-39627 ; Thu, 7 Feb 2013 15:48:05 +0800 From: Gao feng To: netfilter-devel@vger.kernel.org Cc: containers@lists.linux-foundation.org, pablo@netfilter.org, ebiederm@xmission.com, netdev@vger.kernel.org, lve@guap.ru, Gao feng Subject: [PATCH 04/10] netfilter: xt_LOG: add net namespace support for xt_LOG Date: Thu, 7 Feb 2013 15:49:44 +0800 Message-Id: <1360223390-15589-4-git-send-email-gaofeng@cn.fujitsu.com> X-Mailer: git-send-email 1.7.11.7 In-Reply-To: <1360223390-15589-1-git-send-email-gaofeng@cn.fujitsu.com> References: <1360223390-15589-1-git-send-email-gaofeng@cn.fujitsu.com> X-MIMETrack: Itemize by SMTP Server on mailserver/fnst(Release 8.5.3|September 15, 2011) at 2013/02/07 15:48:05, Serialize by Router on mailserver/fnst(Release 8.5.3|September 15, 2011) at 2013/02/07 15:48:05, Serialize complete at 2013/02/07 15:48:05 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Add pernet_operations for xt_LOG, in pernet_ops, we call nf_log_set/unset to set/unset nf_loggers of per net. Because the syslog ns has not been implemented, we don't want the container DOS the host's syslog. so only enable ebt_log in init_net and wait for syslog ns. Signed-off-by: Gao feng --- net/netfilter/xt_LOG.c | 41 ++++++++++++++++++++++++++++++++++++++--- 1 file changed, 38 insertions(+), 3 deletions(-) diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c index fa40096..f49cac4 100644 --- a/net/netfilter/xt_LOG.c +++ b/net/netfilter/xt_LOG.c @@ -474,7 +474,13 @@ ipt_log_packet(u_int8_t pf, const struct nf_loginfo *loginfo, const char *prefix) { - struct sbuff *m = sb_open(); + struct sbuff *m; + struct net *net = dev_net((in != NULL) ? in : out); + + if (!net_eq(net, &init_net)) + return; + + m = sb_open(); if (!loginfo) loginfo = &default_loginfo; @@ -798,7 +804,13 @@ ip6t_log_packet(u_int8_t pf, const struct nf_loginfo *loginfo, const char *prefix) { - struct sbuff *m = sb_open(); + struct sbuff *m; + struct net *net = dev_net((in != NULL) ? in : out); + + if (!net_eq(net, &init_net)) + return; + + m = sb_open(); if (!loginfo) loginfo = &default_loginfo; @@ -893,6 +905,28 @@ static struct nf_logger ip6t_log_logger __read_mostly = { }; #endif +static int __net_init log_net_init(struct net *net) +{ + nf_log_set(net, NFPROTO_IPV4, &ipt_log_logger); +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + nf_log_set(net, NFPROTO_IPV6, &ip6t_log_logger); +#endif + return 0; +} + +static void __net_exit log_net_exit(struct net *net) +{ + nf_log_unset(net, &ipt_log_logger); +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + nf_log_unset(net, &ip6t_log_logger); +#endif +} + +static struct pernet_operations log_net_ops = { + .init = log_net_init, + .exit = log_net_exit, +}; + static int __init log_tg_init(void) { int ret; @@ -905,11 +939,12 @@ static int __init log_tg_init(void) #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) nf_log_register(NFPROTO_IPV6, &ip6t_log_logger); #endif - return 0; + return register_pernet_subsys(&log_net_ops); } static void __exit log_tg_exit(void) { + unregister_pernet_subsys(&log_net_ops); nf_log_unregister(&ipt_log_logger); #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) nf_log_unregister(&ip6t_log_logger);