From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 27/27] netfilter: allow logging from non-init namespaces
Date: Fri, 3 Feb 2017 13:25:38 +0100 [thread overview]
Message-ID: <1486124738-3013-28-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1486124738-3013-1-git-send-email-pablo@netfilter.org>
From: Michal Kubeček <mkubecek@suse.cz>
Commit 69b34fb996b2 ("netfilter: xt_LOG: add net namespace support for
xt_LOG") disabled logging packets using the LOG target from non-init
namespaces. The motivation was to prevent containers from flooding
kernel log of the host. The plan was to keep it that way until syslog
namespace implementation allows containers to log in a safe way.
However, the work on syslog namespace seems to have hit a dead end
somewhere in 2013 and there are users who want to use xt_LOG in all
network namespaces. This patch allows to do so by setting
/proc/sys/net/netfilter/nf_log_all_netns
to a nonzero value. This sysctl is only accessible from init_net so that
one cannot switch the behaviour from inside a container.
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
Documentation/networking/netfilter-sysctl.txt | 10 ++++++++++
include/net/netfilter/nf_log.h | 3 +++
net/bridge/netfilter/ebt_log.c | 2 +-
net/ipv4/netfilter/nf_log_arp.c | 2 +-
net/ipv4/netfilter/nf_log_ipv4.c | 2 +-
net/ipv6/netfilter/nf_log_ipv6.c | 2 +-
net/netfilter/nf_log.c | 24 ++++++++++++++++++++++++
7 files changed, 41 insertions(+), 4 deletions(-)
create mode 100644 Documentation/networking/netfilter-sysctl.txt
diff --git a/Documentation/networking/netfilter-sysctl.txt b/Documentation/networking/netfilter-sysctl.txt
new file mode 100644
index 000000000000..55791e50e169
--- /dev/null
+++ b/Documentation/networking/netfilter-sysctl.txt
@@ -0,0 +1,10 @@
+/proc/sys/net/netfilter/* Variables:
+
+nf_log_all_netns - BOOLEAN
+ 0 - disabled (default)
+ not 0 - enabled
+
+ By default, only init_net namespace can log packets into kernel log
+ with LOG target; this aims to prevent containers from flooding host
+ kernel log. If enabled, this target also works in other network
+ namespaces. This variable is only accessible from init_net.
diff --git a/include/net/netfilter/nf_log.h b/include/net/netfilter/nf_log.h
index 450f87f95415..42e0696f38d8 100644
--- a/include/net/netfilter/nf_log.h
+++ b/include/net/netfilter/nf_log.h
@@ -51,6 +51,9 @@ struct nf_logger {
struct module *me;
};
+/* sysctl_nf_log_all_netns - allow LOG target in all network namespaces */
+extern int sysctl_nf_log_all_netns;
+
/* Function to register/unregister log function. */
int nf_log_register(u_int8_t pf, struct nf_logger *logger);
void nf_log_unregister(struct nf_logger *logger);
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index e88bd4827ac1..98b9c8e8615e 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -78,7 +78,7 @@ ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum,
unsigned int bitmask;
/* FIXME: Disabled from containers until syslog ns is supported */
- if (!net_eq(net, &init_net))
+ if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)
return;
spin_lock_bh(&ebt_log_lock);
diff --git a/net/ipv4/netfilter/nf_log_arp.c b/net/ipv4/netfilter/nf_log_arp.c
index b24795e2ee6d..f6f713376e6e 100644
--- a/net/ipv4/netfilter/nf_log_arp.c
+++ b/net/ipv4/netfilter/nf_log_arp.c
@@ -87,7 +87,7 @@ static void nf_log_arp_packet(struct net *net, u_int8_t pf,
struct nf_log_buf *m;
/* FIXME: Disabled from containers until syslog ns is supported */
- if (!net_eq(net, &init_net))
+ if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)
return;
m = nf_log_buf_open();
diff --git a/net/ipv4/netfilter/nf_log_ipv4.c b/net/ipv4/netfilter/nf_log_ipv4.c
index 856648966f4c..c83a9963269b 100644
--- a/net/ipv4/netfilter/nf_log_ipv4.c
+++ b/net/ipv4/netfilter/nf_log_ipv4.c
@@ -319,7 +319,7 @@ static void nf_log_ip_packet(struct net *net, u_int8_t pf,
struct nf_log_buf *m;
/* FIXME: Disabled from containers until syslog ns is supported */
- if (!net_eq(net, &init_net))
+ if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)
return;
m = nf_log_buf_open();
diff --git a/net/ipv6/netfilter/nf_log_ipv6.c b/net/ipv6/netfilter/nf_log_ipv6.c
index 57d86066a13b..055c51b80f5d 100644
--- a/net/ipv6/netfilter/nf_log_ipv6.c
+++ b/net/ipv6/netfilter/nf_log_ipv6.c
@@ -351,7 +351,7 @@ static void nf_log_ip6_packet(struct net *net, u_int8_t pf,
struct nf_log_buf *m;
/* FIXME: Disabled from containers until syslog ns is supported */
- if (!net_eq(net, &init_net))
+ if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)
return;
m = nf_log_buf_open();
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 3dca90dc24ad..0a034f52b912 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -16,6 +16,9 @@
#define NF_LOG_PREFIXLEN 128
#define NFLOGGER_NAME_LEN 64
+int sysctl_nf_log_all_netns __read_mostly;
+EXPORT_SYMBOL(sysctl_nf_log_all_netns);
+
static struct nf_logger __rcu *loggers[NFPROTO_NUMPROTO][NF_LOG_TYPE_MAX] __read_mostly;
static DEFINE_MUTEX(nf_log_mutex);
@@ -414,6 +417,18 @@ static const struct file_operations nflog_file_ops = {
#ifdef CONFIG_SYSCTL
static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3];
static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1];
+static struct ctl_table_header *nf_log_sysctl_fhdr;
+
+static struct ctl_table nf_log_sysctl_ftable[] = {
+ {
+ .procname = "nf_log_all_netns",
+ .data = &sysctl_nf_log_all_netns,
+ .maxlen = sizeof(sysctl_nf_log_all_netns),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
+ },
+ { }
+};
static int nf_log_proc_dostring(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
@@ -483,6 +498,10 @@ static int netfilter_log_sysctl_init(struct net *net)
nf_log_sysctl_table[i].extra1 =
(void *)(unsigned long) i;
}
+ nf_log_sysctl_fhdr = register_net_sysctl(net, "net/netfilter",
+ nf_log_sysctl_ftable);
+ if (!nf_log_sysctl_fhdr)
+ goto err_freg;
}
for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++)
@@ -499,6 +518,9 @@ static int netfilter_log_sysctl_init(struct net *net)
err_reg:
if (!net_eq(net, &init_net))
kfree(table);
+ else
+ unregister_net_sysctl_table(nf_log_sysctl_fhdr);
+err_freg:
err_alloc:
return -ENOMEM;
}
@@ -511,6 +533,8 @@ static void netfilter_log_sysctl_exit(struct net *net)
unregister_net_sysctl_table(net->nf.nf_log_dir_header);
if (!net_eq(net, &init_net))
kfree(table);
+ else
+ unregister_net_sysctl_table(nf_log_sysctl_fhdr);
}
#else
static int netfilter_log_sysctl_init(struct net *net)
--
2.1.4
next prev parent reply other threads:[~2017-02-03 12:25 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-02-03 12:25 [PATCH 00/27] Netfilter updates for net-next Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 01/27] netfilter: merge udp and udplite conntrack helpers Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 02/27] netfilter: nat: merge udp and udplite helpers Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 03/27] netfilter: nf_tables: add missing descriptions in nft_ct_keys Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 04/27] netfilter: nft_ct: add average bytes per packet support Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 05/27] netfilter: select LIBCRC32C together with SCTP conntrack Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 06/27] netfilter: conntrack: validate SCTP crc32c in PREROUTING Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 07/27] netfilter: xt_connlimit: use rb_entry() Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 08/27] xtables: add xt_match, xt_target and data copy_to_user functions Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 09/27] iptables: use match, target and data copy_to_user helpers Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 10/27] ip6tables: " Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 11/27] arptables: " Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 12/27] ebtables: " Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 13/27] xtables: use match, target and data copy_to_user helpers in compat Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 14/27] xtables: extend matches and targets with .usersize Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 15/27] netfilter: pkttype: unnecessary to check ipv6 multicast address Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 16/27] netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 17/27] netfilter: nf_tables: eliminate useless condition checks Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 18/27] netfilter: nf_tables: Eliminate duplicated code in nf_tables_table_enable() Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 19/27] netfilter: conntrack: no need to pass ctinfo to error handler Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 20/27] netfilter: reset netfilter state when duplicating packet Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 21/27] netfilter: reduce direct skb->nfct usage Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 22/27] skbuff: add and use skb_nfct helper Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 23/27] netfilter: add and use nf_ct_set helper Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 24/27] netfilter: guarantee 8 byte minalign for template addresses Pablo Neira Ayuso
2017-02-06 10:08 ` David Laight
2017-02-03 12:25 ` [PATCH 25/27] netfilter: merge ctinfo into nfct pointer storage area Pablo Neira Ayuso
2017-02-03 12:25 ` [PATCH 26/27] ipvs: free ip_vs_dest structs when refcnt=0 Pablo Neira Ayuso
2017-02-03 12:25 ` Pablo Neira Ayuso [this message]
2017-02-03 22:08 ` [PATCH 00/27] Netfilter updates for net-next David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1486124738-3013-28-git-send-email-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).