From: Gao feng <gaofeng@cn.fujitsu.com>
To: pablo@netfilter.org
Cc: netfilter-devel@vger.kernel.org, netdev@vger.kernel.org,
ebiederm@xmission.com, serge.hallyn@canonical.com,
dlezcano@fr.ibm.com, Gao feng <gaofeng@cn.fujitsu.com>
Subject: [PATCH 00/12] add namespace support for netfilter protos
Date: Tue, 17 Apr 2012 10:56:11 +0800 [thread overview]
Message-ID: <1334631383-12326-1-git-send-email-gaofeng@cn.fujitsu.com> (raw)
Currently the sysctl of netfilter proto is not isolated, so when
changing proto's sysctl in container will cause the host's sysctl
be changed too. it's not expected.
This patch set adds the namespace support for netfilter protos.
impletement four pernet_operations to register sysctl,and disable
register sysctl when protos are registered.
nf_conntrack_net_proto_ipv4_ops is used to register tcp4(compat),
udp4(compat),icmp(compat),ipv4(compat).
nf_conntrack_net_proto_ipv6_ops is used to register tcp6,udp6 and
icmpv6.
nf_conntrack_net_proto_sctp_ops is used to register sctp4(compat)
and sctp6.
nf_conntrack_net_proto_udplite_ops is used to register udplite4
and udplite6
these operations will be registered when module be loaded.
And this will break the cttimeout, because timeout_nlattr_to_obj
function use the orig timeout(such as tcp_timeouts) to set timeouts.
I will fix this in my next patch.
Gao feng (12):
netfilter: add struct netns_ct_proto to support netfilter namespace
netfilter: don't register sysctl when register proto
netfilter: generic proto sysctl support for net namespace
netfilter: tcp proto sysctl support for net namespace
netfilter: udp proto sysctl support for net namespace
netfilter: icmp proto sysctl support for net namespace
netfilter: icmpv6 proto sysctl support for net
netfilter: ipv4 sysctl support for net namespace
netfilter: ipv6 sysctl support for net namespace
netfilter: sctp proto sysctl support for net namespace
netfilter: udplite proto sysctl support for net
netfilter: export necessary function for generic proto
include/linux/netfilter/nf_conntrack_udp.h | 10 +
include/linux/netfilter/nf_conntrack_udplite.h | 10 +
include/net/netfilter/nf_conntrack_core.h | 3 +
include/net/netfilter/nf_conntrack_l3proto.h | 6 -
include/net/netfilter/nf_conntrack_l4proto.h | 38 +++-
include/net/netns/conntrack.h | 37 ++++
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 96 ++++++++-
net/ipv4/netfilter/nf_conntrack_proto_icmp.c | 116 +++++++++-
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 48 ++++
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c | 54 ++++-
net/netfilter/nf_conntrack_core.c | 6 +
net/netfilter/nf_conntrack_proto.c | 109 ++--------
net/netfilter/nf_conntrack_proto_generic.c | 93 ++++++++-
net/netfilter/nf_conntrack_proto_sctp.c | 205 +++++++++++++++---
net/netfilter/nf_conntrack_proto_tcp.c | 275 ++++++++++++++++++++----
net/netfilter/nf_conntrack_proto_udp.c | 160 ++++++++++++--
net/netfilter/nf_conntrack_proto_udplite.c | 83 ++++++--
17 files changed, 1096 insertions(+), 253 deletions(-)
create mode 100644 include/linux/netfilter/nf_conntrack_udp.h
create mode 100644 include/linux/netfilter/nf_conntrack_udplite.h
--
1.7.7.6
next reply other threads:[~2012-04-17 2:56 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-04-17 2:56 Gao feng [this message]
2012-04-17 2:56 ` [PATCH 01/12] netfilter: add struct netns_ct_proto to support netfilter namespace Gao feng
2012-04-17 8:54 ` Pablo Neira Ayuso
2012-04-17 2:56 ` [PATCH 02/12] netfilter: don't register sysctl when register proto Gao feng
2012-04-17 8:56 ` Pablo Neira Ayuso
2012-04-17 10:25 ` Gao feng
2012-04-17 11:26 ` Pablo Neira Ayuso
2012-04-17 2:56 ` [PATCH 03/12] netfilter: generic proto sysctl support for net namespace Gao feng
2012-04-17 8:58 ` Pablo Neira Ayuso
2012-04-17 10:22 ` Gao feng
2012-04-17 11:35 ` Pablo Neira Ayuso
2012-04-18 0:20 ` Gao feng
2012-04-17 2:56 ` [PATCH 04/12] netfilter: tcp " Gao feng
2012-04-17 2:56 ` [PATCH 05/12] netfilter: udp " Gao feng
2012-04-17 2:56 ` [PATCH 06/12] netfilter: icmp " Gao feng
2012-04-17 2:56 ` [PATCH 07/12] netfilter: icmpv6 proto sysctl support for net Gao feng
2012-04-17 2:56 ` [PATCH 08/12] netfilter: ipv4 sysctl support for net namespace Gao feng
2012-04-17 2:56 ` [PATCH 09/12] netfilter: ipv6 " Gao feng
2012-04-17 2:56 ` [PATCH 10/12] netfilter: sctp proto " Gao feng
2012-04-17 10:30 ` Gao feng
2012-04-17 11:29 ` Pablo Neira Ayuso
2012-04-17 2:56 ` [PATCH 11/12] netfilter: udplite proto sysctl support for net Gao feng
2012-04-17 2:56 ` [PATCH 12/12] netfilter: export necessary function for generic proto Gao feng
2012-04-17 9:01 ` Pablo Neira Ayuso
2012-04-17 8:52 ` [PATCH 00/12] add namespace support for netfilter protos Pablo Neira Ayuso
2012-04-17 10:12 ` Gao feng
2012-04-17 10:34 ` Jan Engelhardt
2012-04-17 10:59 ` Pablo Neira Ayuso
2012-04-17 14:35 ` Serge Hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1334631383-12326-1-git-send-email-gaofeng@cn.fujitsu.com \
--to=gaofeng@cn.fujitsu.com \
--cc=dlezcano@fr.ibm.com \
--cc=ebiederm@xmission.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=serge.hallyn@canonical.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).