From: Patrick McHardy <kaber@trash.net>
To: Alexey Dobriyan <adobriyan@sw.ru>
Cc: xemul@openvz.org, netdev@vger.kernel.org,
netfilter-devel@vger.kernel.org, devel@openvz.org
Subject: Re: [PATCH] NETFILTER: per-netns FILTER/MANGLE/RAW tables for real
Date: Thu, 20 Mar 2008 16:29:42 +0100 [thread overview]
Message-ID: <47E282E6.4070907@trash.net> (raw)
In-Reply-To: <20080303160659.GB19059@localhost.sw.ru>
Alexey Dobriyan wrote:
> Commit 9335f047fe61587ec82ff12fbb1220bcfdd32006 aka
> "[NETFILTER]: ip_tables: per-netns FILTER, MANGLE, RAW"
> added per-netns _view_ of iptables rules. They were shown to user, but
> ignored by filtering code. Now that it's possible to at least ping loopback,
> per-netns tables can affect filtering decisions.
>
> netns is taken in case of
> PRE_ROUTING, LOCAL_IN -- from in device,
> POST_ROUTING, LOCAL_OUT -- from out device,
> FORWARD -- from in device which should be equal to out device's netns.
> This code is relatively new, so BUG_ON was plugged.
>
> Wrappers were added to a) keep code the same from CONFIG_NET_NS=n users
> (overwhelming majority), b) consolidate code in one place -- similar
> changes will be done in ipv6 and arp netfilter code.
Applied, thanks.
prev parent reply other threads:[~2008-03-20 15:29 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-03-03 16:06 [PATCH] NETFILTER: per-netns FILTER/MANGLE/RAW tables for real Alexey Dobriyan
2008-03-20 15:29 ` Patrick McHardy [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=47E282E6.4070907@trash.net \
--to=kaber@trash.net \
--cc=adobriyan@sw.ru \
--cc=devel@openvz.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=xemul@openvz.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.