From patchwork Mon Mar 25 09:50:41 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gao feng X-Patchwork-Id: 230596 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 696CC2C00AC for ; Mon, 25 Mar 2013 20:50:11 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756155Ab3CYJuI (ORCPT ); Mon, 25 Mar 2013 05:50:08 -0400 Received: from cn.fujitsu.com ([222.73.24.84]:26027 "EHLO song.cn.fujitsu.com" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1755121Ab3CYJuI (ORCPT ); Mon, 25 Mar 2013 05:50:08 -0400 X-IronPort-AV: E=Sophos;i="4.87,344,1363104000"; d="scan'208";a="6939799" Received: from unknown (HELO tang.cn.fujitsu.com) ([10.167.250.3]) by song.cn.fujitsu.com with ESMTP; 25 Mar 2013 17:47:35 +0800 Received: from fnstmail02.fnst.cn.fujitsu.com (tang.cn.fujitsu.com [127.0.0.1]) by tang.cn.fujitsu.com (8.14.3/8.13.1) with ESMTP id r2P9o4u5026924; Mon, 25 Mar 2013 17:50:04 +0800 Received: from Donkey.fnst.cn.fujitsu.com ([10.167.233.107]) by fnstmail02.fnst.cn.fujitsu.com (Lotus Domino Release 8.5.3) with ESMTP id 2013032517491988-27852 ; Mon, 25 Mar 2013 17:49:19 +0800 From: Gao feng To: netfilter-devel@vger.kernel.org Cc: pablo@netfilter.org, Gao feng Subject: [PATCH nf-next v2 03/10] netfilter: ebt_log: add net namespace support for ebt_log Date: Mon, 25 Mar 2013 17:50:41 +0800 Message-Id: <1364205048-32632-3-git-send-email-gaofeng@cn.fujitsu.com> X-Mailer: git-send-email 1.7.11.7 In-Reply-To: <1364205048-32632-1-git-send-email-gaofeng@cn.fujitsu.com> References: <1364205048-32632-1-git-send-email-gaofeng@cn.fujitsu.com> X-MIMETrack: Itemize by SMTP Server on mailserver/fnst(Release 8.5.3|September 15, 2011) at 2013/03/25 17:49:19, Serialize by Router on mailserver/fnst(Release 8.5.3|September 15, 2011) at 2013/03/25 17:49:22, Serialize complete at 2013/03/25 17:49:22 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Add pernet_operations for ebt_log, in pernet_ops, we call nf_log_set/unset to set/unset nf_loggers of per net. Because the syslog ns has not been implemented, we don't want the container DDOS the host's syslog. so only enable ebt_log in init_net and wait for syslog ns. Signed-off-by: Gao feng --- net/bridge/netfilter/ebt_log.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c index 08e5ea5..cd465d1 100644 --- a/net/bridge/netfilter/ebt_log.c +++ b/net/bridge/netfilter/ebt_log.c @@ -78,6 +78,10 @@ ebt_log_packet(u_int8_t pf, unsigned int hooknum, const char *prefix) { unsigned int bitmask; + struct net *net = dev_net(in ? in : out); + + if (!net_eq(net, &init_net)) + return; spin_lock_bh(&ebt_log_lock); printk(KERN_SOH "%c%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x", @@ -207,6 +211,22 @@ static struct nf_logger ebt_log_logger __read_mostly = { .me = THIS_MODULE, }; +static int __net_init ebt_log_net_init(struct net *net) +{ + nf_log_set(net, NFPROTO_BRIDGE, &ebt_log_logger); + return 0; +} + +static void __net_exit ebt_log_net_fini(struct net *net) +{ + nf_log_unset(net, &ebt_log_logger); +} + +static struct pernet_operations ebt_log_net_ops = { + .init = ebt_log_net_init, + .exit = ebt_log_net_fini, +}; + static int __init ebt_log_init(void) { int ret; @@ -214,12 +234,14 @@ static int __init ebt_log_init(void) ret = xt_register_target(&ebt_log_tg_reg); if (ret < 0) return ret; + nf_log_register(NFPROTO_BRIDGE, &ebt_log_logger); - return 0; + return register_pernet_subsys(&ebt_log_net_ops); } static void __exit ebt_log_fini(void) { + unregister_pernet_subsys(&ebt_log_net_ops); nf_log_unregister(&ebt_log_logger); xt_unregister_target(&ebt_log_tg_reg); }