Skip to contentSkip to conversation

netns netfilter: per-netns ip6tables

PATCH Applied Alexey Dobriyan 2 participants 3 messages Jan 24, 2008 – Jan 25, 2008

Subsystems (3)
Networking Network drivers netfilter
lore
Share & tools
lore

Alexey Dobriyan

author
#0 lore raw

PATCH 1/5 netns netfilter: per-netns ip6tables

* Propagate netns from userspace down to xt_find_table_lock()
* Register ip6 tables in netns (modules still use init_net)

Signed-off-by Alexey Dobriyan <[email protected]>

---

 include/linux/netfilter_ipv6/ip6_tables.h |    3 +
 net/ipv6/netfilter/ip6_tables.c           |   50 +++++++++++++++---------------
 net/ipv6/netfilter/ip6table_filter.c      |    2 -
 net/ipv6/netfilter/ip6table_mangle.c      |    2 -
 net/ipv6/netfilter/ip6table_raw.c         |    2 -
 5 files changed, 31 insertions(+), 28 deletions(-)
include/linux/netfilter_ipv6/ip6_tables.h +2 -1
@@ -305,7 +305,8 @@ ip6t_get_target(struct ip6t_entry *e)
 #include <linux/init.h>
 extern void ip6t_init(void) __init;
 
-extern struct xt_table *ip6t_register_table(struct xt_table *table,
+extern struct xt_table *ip6t_register_table(struct net *net,
+					    struct xt_table *table,
 					    const struct ip6t_replace *repl);
 extern void ip6t_unregister_table(struct xt_table *table);
 extern unsigned int ip6t_do_table(struct sk_buff *skb,
net/ipv6/netfilter/ip6_tables.c +26 -24

181 lines not on this page · raw message

net/ipv6/netfilter/ip6table_filter.c +1 -1
@@ -132,7 +132,7 @@ static int __init ip6table_filter_init(void)
 	initial_table.entries[1].target.verdict = -forward - 1;
 
 	/* Register table */
-	packet_filter = ip6t_register_table(&__packet_filter, &initial_table.repl);
+	packet_filter = ip6t_register_table(&init_net, &__packet_filter, &initial_table.repl);
 	if (IS_ERR(packet_filter))
 		return PTR_ERR(packet_filter);
net/ipv6/netfilter/ip6table_mangle.c +1 -1
@@ -164,7 +164,7 @@ static int __init ip6table_mangle_init(void)
 	int ret;
 
 	/* Register table */
-	packet_mangler = ip6t_register_table(&__packet_mangler, &initial_table.repl);
+	packet_mangler = ip6t_register_table(&init_net, &__packet_mangler, &initial_table.repl);
 	if (IS_ERR(packet_mangler))
 		return PTR_ERR(packet_mangler);
net/ipv6/netfilter/ip6table_raw.c +1 -1
@@ -77,7 +77,7 @@ static int __init ip6table_raw_init(void)
 	int ret;
 
 	/* Register table */
-	packet_raw = ip6t_register_table(&__packet_raw, &initial_table.repl);
+	packet_raw = ip6t_register_table(&init_net, &__packet_raw, &initial_table.repl);
 	if (IS_ERR(packet_raw))
 		return PTR_ERR(packet_raw);
#1 lore raw
Quoted 4 lines · Alexey Dobriyan

* Propagate netns from userspace down to xt_find_table_lock()
* Register ip6 tables in netns (modules still use init_net)

Signed-off-by Alexey Dobriyan <[email protected]>
Quoted 8 lines

---

 include/linux/netfilter_ipv6/ip6_tables.h |    3 +
 net/ipv6/netfilter/ip6_tables.c           |   50 +++++++++++++++---------------
 net/ipv6/netfilter/ip6table_filter.c      |    2 -
 net/ipv6/netfilter/ip6table_mangle.c      |    2 -
 net/ipv6/netfilter/ip6table_raw.c         |    2 -
 5 files changed, 31 insertions(+), 28 deletions(-)

This adds checkpatch warnings:

WARNING: line over 80 characters
#96: FILE: net/ipv6/netfilter/ip6_tables.c:1361:
+do_add_counters(struct net *net, void __user *user, unsigned int len, int compat)

WARNING: line over 80 characters
#229: FILE: net/ipv6/netfilter/ip6table_filter.c:135:
+ packet_filter = ip6t_register_table(&init_net, &__packet_filter, &initial_table.repl);

WARNING: line over 80 characters
#242: FILE: net/ipv6/netfilter/ip6table_mangle.c:167:
+ packet_mangler = ip6t_register_table(&init_net, &__packet_mangler, &initial_table.repl);

WARNING: line over 80 characters
#255: FILE: net/ipv6/netfilter/ip6table_raw.c:80:
+ packet_raw = ip6t_register_table(&init_net, &__packet_raw, &initial_table.repl);

ERROR: Missing Signed-off-by: line(s)

total: 1 errors, 4 warnings, 214 lines checked

I'll fix them up, lets hope that it doesn't cause clashes with the following patches.

author
#2 lore raw
Quoted 32 lines · Patrick McHardy
Quoted 6 lines · Alexey Dobriyan

* Propagate netns from userspace down to xt_find_table_lock()
* Register ip6 tables in netns (modules still use init_net)

Signed-off-by Alexey Dobriyan <[email protected]>

---

Quoted 7 lines

include/linux/netfilter_ipv6/ip6_tables.h | 3 +
net/ipv6/netfilter/ip6_tables.c | 50
+++++++++++++++---------------

net/ipv6/netfilter/ip6table_filter.c      |    2 -
net/ipv6/netfilter/ip6table_mangle.c      |    2 -
net/ipv6/netfilter/ip6table_raw.c         |    2 -
5 files changed, 31 insertions(+), 28 deletions(-)

This adds checkpatch warnings:

WARNING: line over 80 characters
#96: FILE: net/ipv6/netfilter/ip6_tables.c:1361:
+do_add_counters(struct net *net, void __user *user, unsigned int len, int compat)

WARNING: line over 80 characters
#229: FILE: net/ipv6/netfilter/ip6table_filter.c:135:
+ packet_filter = ip6t_register_table(&init_net, &__packet_filter,
&initial_table.repl);

WARNING: line over 80 characters
#242: FILE: net/ipv6/netfilter/ip6table_mangle.c:167:
+ packet_mangler = ip6t_register_table(&init_net,
&__packet_mangler, &initial_table.repl);

Quoted 6 lines

WARNING: line over 80 characters
#255: FILE: net/ipv6/netfilter/ip6table_raw.c:80:
+ packet_raw = ip6t_register_table(&init_net, &__packet_raw,
&initial_table.repl);

ERROR: Missing Signed-off-by: line(s)

Well, SOB line definitely was present.

Quoted 4 lines

total: 1 errors, 4 warnings, 214 lines checked

I'll fix them up, lets hope that it doesn't cause clashes with the following patches.

OK. It was quantum coding style violation. :-)