Message ID | 1364205048-32632-3-git-send-email-gaofeng@cn.fujitsu.com |
---|---|
State | Accepted |
Headers | show |
On Mon, Mar 25, 2013 at 05:50:41PM +0800, Gao feng wrote: > Add pernet_operations for ebt_log, in pernet_ops, > we call nf_log_set/unset to set/unset nf_loggers > of per net. > > Because the syslog ns has not been implemented, > we don't want the container DDOS the host's syslog. > so only enable ebt_log in init_net and wait for > syslog ns. Applied with change. > Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> > --- > net/bridge/netfilter/ebt_log.c | 24 +++++++++++++++++++++++- > 1 file changed, 23 insertions(+), 1 deletion(-) > > diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c > index 08e5ea5..cd465d1 100644 > --- a/net/bridge/netfilter/ebt_log.c > +++ b/net/bridge/netfilter/ebt_log.c > @@ -78,6 +78,10 @@ ebt_log_packet(u_int8_t pf, unsigned int hooknum, > const char *prefix) > { > unsigned int bitmask; > + struct net *net = dev_net(in ? in : out); > + Added a comment here to explicitly recall that we depend on syslog ns support to remove these two lines below. > + if (!net_eq(net, &init_net)) > + return; > > spin_lock_bh(&ebt_log_lock); > printk(KERN_SOH "%c%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x", > @@ -207,6 +211,22 @@ static struct nf_logger ebt_log_logger __read_mostly = { > .me = THIS_MODULE, > }; > > +static int __net_init ebt_log_net_init(struct net *net) > +{ > + nf_log_set(net, NFPROTO_BRIDGE, &ebt_log_logger); > + return 0; > +} > + > +static void __net_exit ebt_log_net_fini(struct net *net) > +{ > + nf_log_unset(net, &ebt_log_logger); > +} > + > +static struct pernet_operations ebt_log_net_ops = { > + .init = ebt_log_net_init, > + .exit = ebt_log_net_fini, > +}; > + > static int __init ebt_log_init(void) > { > int ret; > @@ -214,12 +234,14 @@ static int __init ebt_log_init(void) > ret = xt_register_target(&ebt_log_tg_reg); > if (ret < 0) > return ret; > + > nf_log_register(NFPROTO_BRIDGE, &ebt_log_logger); > - return 0; > + return register_pernet_subsys(&ebt_log_net_ops); You have to unroll in case register_pernet_subsys, I fixed this. > } > > static void __exit ebt_log_fini(void) > { > + unregister_pernet_subsys(&ebt_log_net_ops); > nf_log_unregister(&ebt_log_logger); > xt_unregister_target(&ebt_log_tg_reg); > } > -- > 1.7.11.7 > -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 2013/04/06 02:32, Pablo Neira Ayuso wrote: > On Mon, Mar 25, 2013 at 05:50:41PM +0800, Gao feng wrote: >> Add pernet_operations for ebt_log, in pernet_ops, >> we call nf_log_set/unset to set/unset nf_loggers >> of per net. >> >> Because the syslog ns has not been implemented, >> we don't want the container DDOS the host's syslog. >> so only enable ebt_log in init_net and wait for >> syslog ns. > > Applied with change. > >> Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> >> --- >> net/bridge/netfilter/ebt_log.c | 24 +++++++++++++++++++++++- >> 1 file changed, 23 insertions(+), 1 deletion(-) >> >> diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c >> index 08e5ea5..cd465d1 100644 >> --- a/net/bridge/netfilter/ebt_log.c >> +++ b/net/bridge/netfilter/ebt_log.c >> @@ -78,6 +78,10 @@ ebt_log_packet(u_int8_t pf, unsigned int hooknum, >> const char *prefix) >> { >> unsigned int bitmask; >> + struct net *net = dev_net(in ? in : out); >> + > > Added a comment here to explicitly recall that we depend on syslog ns > support to remove these two lines below. > This is good, and I will note this too. >> + if (!net_eq(net, &init_net)) >> + return; >> >> spin_lock_bh(&ebt_log_lock); >> printk(KERN_SOH "%c%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x", >> @@ -207,6 +211,22 @@ static struct nf_logger ebt_log_logger __read_mostly = { >> .me = THIS_MODULE, >> }; >> >> +static int __net_init ebt_log_net_init(struct net *net) >> +{ >> + nf_log_set(net, NFPROTO_BRIDGE, &ebt_log_logger); >> + return 0; >> +} >> + >> +static void __net_exit ebt_log_net_fini(struct net *net) >> +{ >> + nf_log_unset(net, &ebt_log_logger); >> +} >> + >> +static struct pernet_operations ebt_log_net_ops = { >> + .init = ebt_log_net_init, >> + .exit = ebt_log_net_fini, >> +}; >> + >> static int __init ebt_log_init(void) >> { >> int ret; >> @@ -214,12 +234,14 @@ static int __init ebt_log_init(void) >> ret = xt_register_target(&ebt_log_tg_reg); >> if (ret < 0) >> return ret; >> + >> nf_log_register(NFPROTO_BRIDGE, &ebt_log_logger); >> - return 0; >> + return register_pernet_subsys(&ebt_log_net_ops); > > You have to unroll in case register_pernet_subsys, I fixed this. > This is my mistake,thanks for your fix :) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c index 08e5ea5..cd465d1 100644 --- a/net/bridge/netfilter/ebt_log.c +++ b/net/bridge/netfilter/ebt_log.c @@ -78,6 +78,10 @@ ebt_log_packet(u_int8_t pf, unsigned int hooknum, const char *prefix) { unsigned int bitmask; + struct net *net = dev_net(in ? in : out); + + if (!net_eq(net, &init_net)) + return; spin_lock_bh(&ebt_log_lock); printk(KERN_SOH "%c%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x", @@ -207,6 +211,22 @@ static struct nf_logger ebt_log_logger __read_mostly = { .me = THIS_MODULE, }; +static int __net_init ebt_log_net_init(struct net *net) +{ + nf_log_set(net, NFPROTO_BRIDGE, &ebt_log_logger); + return 0; +} + +static void __net_exit ebt_log_net_fini(struct net *net) +{ + nf_log_unset(net, &ebt_log_logger); +} + +static struct pernet_operations ebt_log_net_ops = { + .init = ebt_log_net_init, + .exit = ebt_log_net_fini, +}; + static int __init ebt_log_init(void) { int ret; @@ -214,12 +234,14 @@ static int __init ebt_log_init(void) ret = xt_register_target(&ebt_log_tg_reg); if (ret < 0) return ret; + nf_log_register(NFPROTO_BRIDGE, &ebt_log_logger); - return 0; + return register_pernet_subsys(&ebt_log_net_ops); } static void __exit ebt_log_fini(void) { + unregister_pernet_subsys(&ebt_log_net_ops); nf_log_unregister(&ebt_log_logger); xt_unregister_target(&ebt_log_tg_reg); }
Add pernet_operations for ebt_log, in pernet_ops, we call nf_log_set/unset to set/unset nf_loggers of per net. Because the syslog ns has not been implemented, we don't want the container DDOS the host's syslog. so only enable ebt_log in init_net and wait for syslog ns. Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com> --- net/bridge/netfilter/ebt_log.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)