nfnetlink: netns support
Subsystems (2)
PATCH v2 1/2 nfnetlink: netns support
Make nfnl socket per-petns.
---
include/linux/netfilter/nfnetlink.h | 8 ++-- include/net/net_namespace.h | 2 + net/netfilter/nf_conntrack_netlink.c | 13 +++---- net/netfilter/nfnetlink.c | 65 ++++++++++++++++++++++------------- net/netfilter/nfnetlink_log.c | 3 + net/netfilter/nfnetlink_queue.c | 2 - 6 files changed, 58 insertions(+), 35 deletions(-)
include/linux/netfilter/nfnetlink.h +4 -4
@@ -73,11 +73,11 @@ struct nfnetlink_subsystem {extern int nfnetlink_subsys_register (const struct nfnetlink_subsystem *n);extern int nfnetlink_subsys_unregister (const struct nfnetlink_subsystem *n); -extern int nfnetlink_has_listeners (unsigned int group); -extern int nfnetlink_send (struct sk_buff *skb,u32 pid,unsigned group, +extern int nfnetlink_has_listeners (struct net *net,unsigned int group); +extern int nfnetlink_send (struct sk_buff *skb,struct net *net,u32 pid,unsigned group,int echo,gfp_t flags); -extern void nfnetlink_set_err (u32 pid,u32 group,int error); -extern int nfnetlink_unicast (struct sk_buff *skb,u_int32_t pid,int flags); +extern void nfnetlink_set_err (struct net *net,u32 pid,u32 group,int error); +extern int nfnetlink_unicast (struct sk_buff *skb,struct net *net,u_int32_t pid,int flags);extern void nfnl_lock (void );extern void nfnl_unlock (void );
include/net/net_namespace.h +2 -0
@@ -81,6 +81,8 @@ struct net {#if defined(CONFIG_NF_CONNTRACK ) || defined(CONFIG_NF_CONNTRACK_MODULE )struct netns_ct ct;#endif +struct sock *nfnl; +struct sock *nfnl_stash;#endif #ifdef CONFIG_XFRM struct netns_xfrm xfrm;
net/netfilter/nf_conntrack_netlink.c +7 -6
@@ -482,7 +482,7 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item) }else return 0 ; -if (!item->report && !nfnetlink_has_listeners (group)) +if (!item->report && !nfnetlink_has_listeners (&init_net, group))return 0 ; skb =nlmsg_new (ctnetlink_nlmsg_size (ct),GFP_ATOMIC );
@@ -559,7 +559,8 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)rcu_read_unlock ();nlmsg_end (skb, nlh); - err =nfnetlink_send (skb, item->pid, group, item->report,GFP_ATOMIC ); + err =nfnetlink_send (skb, &init_net, item->pid, group, item->report, +GFP_ATOMIC );if (err == -ENOBUFS || err == -EAGAIN )return -ENOBUFS ;
@@ -571,7 +572,7 @@ nla_put_failure: nlmsg_failure:kfree_skb (skb); errout: -nfnetlink_set_err (0 , group, -ENOBUFS ); +nfnetlink_set_err (&init_net,0 , group, -ENOBUFS ); return 0; }#endif /* CONFIG_NF_CONNTRACK_EVENTS */
@@ -1539,7 +1540,7 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)return 0 ;if (!item->report && - !nfnetlink_has_listeners (NFNLGRP_CONNTRACK_EXP_NEW )) + !nfnetlink_has_listeners (&init_net,NFNLGRP_CONNTRACK_EXP_NEW ))return 0 ; skb =nlmsg_new (NLMSG_DEFAULT_SIZE ,GFP_ATOMIC );
@@ -1562,7 +1563,7 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)rcu_read_unlock ();nlmsg_end (skb, nlh); -nfnetlink_send (skb, item->pid,NFNLGRP_CONNTRACK_EXP_NEW , +nfnetlink_send (skb, &init_net, item->pid,NFNLGRP_CONNTRACK_EXP_NEW , item->report,GFP_ATOMIC );return 0 ;
@@ -1572,7 +1573,7 @@ nla_put_failure: nlmsg_failure:kfree_skb (skb); errout: -nfnetlink_set_err (0 ,0 , -ENOBUFS ); +nfnetlink_set_err (&init_net,0 ,0 , -ENOBUFS ); return 0; }#endif
net/netfilter/nfnetlink.c +42 -23
116 lines not on this page · raw message
net/netfilter/nfnetlink_log.c +2 -1
@@ -323,7 +323,8 @@ __nfulnl_send(struct nfulnl_instance *inst)NLMSG_DONE , sizeof(struct nfgenmsg)); - status =nfnetlink_unicast (inst->skb, inst->peer_pid,MSG_DONTWAIT ); + status =nfnetlink_unicast (inst->skb, &init_net, inst->peer_pid, +MSG_DONTWAIT ); inst->qlen =0 ; inst->skb =NULL ;
net/netfilter/nfnetlink_queue.c +1 -1
@@ -420,7 +420,7 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum) }/* nfnetlink_unicast will either free the nskb or add it to a socket */ - err =nfnetlink_unicast (nskb, queue->peer_pid,MSG_DONTWAIT ); + err =nfnetlink_unicast (nskb, &init_net, queue->peer_pid,MSG_DONTWAIT );if (err <0 ) { queue->queue_user_dropped++; goto err_out_unlock;
Patrick McHardy
AppliedQuoted 1 line · Alexey Dobriyan
Make nfnl socket per-petns.
Applied, thanks.
Patrick McHardy
AppliedQuoted 1 line · Alexey Dobriyan
Make nfnl socket per-petns.
Applied, thanks.
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 4 lines · Patrick McHardy
Quoted 1 line · Alexey Dobriyan
Make nfnl socket per-petns.
Applied, thanks.
While merging the nf-next tree with the changes from net-next I noticed that this patch allows any namespace to send configurations and verdicts to nfnetlink_{log,queue}. It seems you need to add a check for init_net to their recv functions unless I'm missing something.
Quoted 4 lines · Patrick McHardy
Quoted 1 line · Alexey Dobriyan
Make nfnl socket per-petns.
Applied, thanks.
While merging the nf-next tree with the changes from net-next I noticed that this patch allows any namespace to send configurations and verdicts to nfnetlink_{log,queue}. It seems you need to add a check for init_net to their recv functions unless I'm missing something.
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 4 lines · Patrick McHardy
While merging the nf-next tree with the changes from net-next I noticed that this patch allows any namespace to send configurations and verdicts to nfnetlink_{log,queue}. It seems you need to add a check for
init_netto their recv functions unless I'm missing something.
netns NFLOG support is mostly ready. I'll send it once new merge window opens.
Quoted 4 lines · Patrick McHardy
While merging the nf-next tree with the changes from net-next I noticed that this patch allows any namespace to send configurations and verdicts to nfnetlink_{log,queue}. It seems you need to add a check for
init_netto their recv functions unless I'm missing something.
netns NFLOG support is mostly ready. I'll send it once new merge window opens.