[PATCH] arptables in netns for real

[PATCH] arptables in netns for real

[Alexey Dobriyan]

IN, FORWARD -- grab netns from in device,
OUT -- from out device.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
---

 net/ipv4/netfilter/arptable_filter.c |   39 ++++++++++++++++++++++++++---------
 1 file changed, 30 insertions(+), 9 deletions(-)

--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -55,32 +55,53 @@ static struct xt_table packet_filter = {
 };
 
 /* The work comes in here from netfilter.c */
-static unsigned int arpt_hook(unsigned int hook,
-			      struct sk_buff *skb,
-			      const struct net_device *in,
-			      const struct net_device *out,
-			      int (*okfn)(struct sk_buff *))
+static unsigned int arpt_in_hook(unsigned int hook,
+				 struct sk_buff *skb,
+				 const struct net_device *in,
+				 const struct net_device *out,
+				 int (*okfn)(struct sk_buff *))
 {
-	return arpt_do_table(skb, hook, in, out, init_net.ipv4.arptable_filter);
+	return arpt_do_table(skb, hook, in, out,
+			     dev_net(in)->ipv4.arptable_filter);
+}
+
+static unsigned int arpt_out_hook(unsigned int hook,
+				  struct sk_buff *skb,
+				  const struct net_device *in,
+				  const struct net_device *out,
+				  int (*okfn)(struct sk_buff *))
+{
+	return arpt_do_table(skb, hook, in, out,
+			     dev_net(out)->ipv4.arptable_filter);
+}
+
+static unsigned int arpt_forward_hook(unsigned int hook,
+				      struct sk_buff *skb,
+				      const struct net_device *in,
+				      const struct net_device *out,
+				      int (*okfn)(struct sk_buff *))
+{
+	return arpt_do_table(skb, hook, in, out,
+			     dev_net(in)->ipv4.arptable_filter);
 }
 
 static struct nf_hook_ops arpt_ops[] __read_mostly = {
 	{
-		.hook		= arpt_hook,
+		.hook		= arpt_in_hook,
 		.owner		= THIS_MODULE,
 		.pf		= NF_ARP,
 		.hooknum	= NF_ARP_IN,
 		.priority	= NF_IP_PRI_FILTER,
 	},
 	{
-		.hook		= arpt_hook,
+		.hook		= arpt_out_hook,
 		.owner		= THIS_MODULE,
 		.pf		= NF_ARP,
 		.hooknum	= NF_ARP_OUT,
 		.priority	= NF_IP_PRI_FILTER,
 	},
 	{
-		.hook		= arpt_hook,
+		.hook		= arpt_forward_hook,
 		.owner		= THIS_MODULE,
 		.pf		= NF_ARP,
 		.hooknum	= NF_ARP_FORWARD,
-- 
1.5.4.5

Re: [PATCH] arptables in netns for real

[Patrick McHardy]

Alexey Dobriyan wrote:
> IN, FORWARD -- grab netns from in device,
> OUT -- from out device.

Applied, thanks.

Re: [PATCH] arptables in netns for real

[Jan Engelhardt]

On Monday 2008-07-21 18:29, Alexey Dobriyan wrote:
>-			      int (*okfn)(struct sk_buff *))
>+static unsigned int arpt_in_hook(unsigned int hook,
>+				 struct sk_buff *skb,
>+				 const struct net_device *in,
>+				 const struct net_device *out,
>+				 int (*okfn)(struct sk_buff *))
> {
>-	return arpt_do_table(skb, hook, in, out, init_net.ipv4.arptable_filter);
>+	return arpt_do_table(skb, hook, in, out,
>+			     dev_net(in)->ipv4.arptable_filter);
>+}

What I dislike with this netns stuff is that you need to touch
the ->ipv4. structure if you want to add new tables and there is
no more way to dynamically add tables from 3rd party modules unless
the admin loading them is fine with having them register against
&init_net only.

Re: [PATCH] arptables in netns for real

[Alexey Dobriyan]

On Mon, Jul 21, 2008 at 06:47:22PM +0200, Jan Engelhardt wrote:
> On Monday 2008-07-21 18:29, Alexey Dobriyan wrote:
> >-			      int (*okfn)(struct sk_buff *))
> >+static unsigned int arpt_in_hook(unsigned int hook,
> >+				 struct sk_buff *skb,
> >+				 const struct net_device *in,
> >+				 const struct net_device *out,
> >+				 int (*okfn)(struct sk_buff *))
> > {
> >-	return arpt_do_table(skb, hook, in, out, init_net.ipv4.arptable_filter);
> >+	return arpt_do_table(skb, hook, in, out,
> >+			     dev_net(in)->ipv4.arptable_filter);
> >+}
> 
> What I dislike with this netns stuff is that you need to touch
> the ->ipv4. structure if you want to add new tables and there is
> no more way to dynamically add tables from 3rd party modules unless
> the admin loading them is fine with having them register against
> &init_net only.

Not exactly sure, if it's sufficient for you, you can use
net_assign_generic() infrastructure from module and not touch "struct net"
at all.