Re: [PATCH 9/9] netfilter: use ns_printk in iptable context

[Rui Xiang <rui.xiang-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>]

On 2013/7/29 17:48, Gao feng wrote:
> On 07/29/2013 10:31 AM, Rui Xiang wrote:
>> To containerise iptables log, use ns_printk
>> to report individual logs to container as
>> getting syslog_ns from skb->dev->nd_net->user_ns.
>>
>> Signed-off-by: Rui Xiang <rui.xiang-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>
>> ---
>>  include/net/netfilter/xt_log.h | 6 +++++-
>>  net/netfilter/xt_LOG.c         | 4 ++--
>>  2 files changed, 7 insertions(+), 3 deletions(-)
>>
>> diff --git a/include/net/netfilter/xt_log.h b/include/net/netfilter/xt_log.h
>> index 9d9756c..5222cba 100644
>> --- a/include/net/netfilter/xt_log.h
>> +++ b/include/net/netfilter/xt_log.h
>> @@ -39,10 +39,14 @@ static struct sbuff *sb_open(void)
>>  	return m;
>>  }
>>  
>> -static void sb_close(struct sbuff *m)
>> +static void sb_close(struct sbuff *m, struct sk_buff *skb)
>>  {
>>  	m->buf[m->count] = 0;
>> +#ifdef CONFIG_NET_NS
>> +	ns_printk(skb->dev->nd_net->user_ns->syslog_ns, "%s\n", m->buf);
>> +#else
>>  	printk("%s\n", m->buf);
>> +#endif
>>  
>>  	if (likely(m != &emergency))
>>  		kfree(m);
>> diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
>> index 5ab2484..f2cd2fa3 100644
>> --- a/net/netfilter/xt_LOG.c
>> +++ b/net/netfilter/xt_LOG.c
>> @@ -493,7 +493,7 @@ ipt_log_packet(struct net *net,
>>  
>>  	dump_ipv4_packet(m, loginfo, skb, 0);
>>  
>> -	sb_close(m);
>> +	sb_close(m, skb);
> 
> 
> why don't you pass net directly to sb_close here?
> 
> un init net namespace will not trigger any system log through ipt_LOG/ip6t_LOG.
> You can check the FIXME in ipt_log_packet.
> 
> BTW,for this patch,you should cc netfilter-devel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org too.
> 
Hi Gao,

Thanks for your attention.

Yes, you are right. In the 1st version, there was no net parameter in ipt_log_packet
function. Here I didn't do any amendment. And I will alter it in next version.



Thanks.