From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Jan Engelhardt <jengelh@medozas.de>
Cc: Gao feng <gaofeng@cn.fujitsu.com>,
netfilter-devel@vger.kernel.org, netdev@vger.kernel.org,
ebiederm@xmission.com, serge.hallyn@canonical.com,
dlezcano@fr.ibm.com
Subject: Re: [PATCH 00/12] add namespace support for netfilter protos
Date: Tue, 17 Apr 2012 12:59:00 +0200 [thread overview]
Message-ID: <20120417105900.GA2765@1984> (raw)
In-Reply-To: <alpine.LNX.2.01.1204171233590.31683@frira.zrqbmnf.qr>
On Tue, Apr 17, 2012 at 12:34:48PM +0200, Jan Engelhardt wrote:
>
> On Tuesday 2012-04-17 04:56, Gao feng wrote:
>
> >Currently the sysctl of netfilter proto is not isolated, so when
> >changing proto's sysctl in container will cause the host's sysctl
> >be changed too. it's not expected.
>
> I wonder if it made sense to do the configuration of NFCT via
> netlink as well, and deprecate the sysctl interface.
Good point Jan.
However, we're in inconsistent state now and removing interfaces is
not easy / fast.
So I think we have to fix it first and then, if we decide to do so,
deprecate them.
It seems to me like a good idea to target to providing netlink
interfaces for all netfilter tweaks and use iptables (or whatsoever.
command line tool we'll have in the future) to attach specific
configurations to flow.
Thus, having no more sysctl stuff and module parameters tweaks.
next prev parent reply other threads:[~2012-04-17 10:59 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-04-17 2:56 [PATCH 00/12] add namespace support for netfilter protos Gao feng
2012-04-17 2:56 ` [PATCH 01/12] netfilter: add struct netns_ct_proto to support netfilter namespace Gao feng
2012-04-17 8:54 ` Pablo Neira Ayuso
2012-04-17 2:56 ` [PATCH 02/12] netfilter: don't register sysctl when register proto Gao feng
2012-04-17 8:56 ` Pablo Neira Ayuso
2012-04-17 10:25 ` Gao feng
2012-04-17 11:26 ` Pablo Neira Ayuso
2012-04-17 2:56 ` [PATCH 03/12] netfilter: generic proto sysctl support for net namespace Gao feng
2012-04-17 8:58 ` Pablo Neira Ayuso
2012-04-17 10:22 ` Gao feng
2012-04-17 11:35 ` Pablo Neira Ayuso
2012-04-18 0:20 ` Gao feng
2012-04-17 2:56 ` [PATCH 04/12] netfilter: tcp " Gao feng
2012-04-17 2:56 ` [PATCH 05/12] netfilter: udp " Gao feng
2012-04-17 2:56 ` [PATCH 06/12] netfilter: icmp " Gao feng
2012-04-17 2:56 ` [PATCH 07/12] netfilter: icmpv6 proto sysctl support for net Gao feng
2012-04-17 2:56 ` [PATCH 08/12] netfilter: ipv4 sysctl support for net namespace Gao feng
2012-04-17 2:56 ` [PATCH 09/12] netfilter: ipv6 " Gao feng
2012-04-17 2:56 ` [PATCH 10/12] netfilter: sctp proto " Gao feng
2012-04-17 10:30 ` Gao feng
2012-04-17 11:29 ` Pablo Neira Ayuso
2012-04-17 2:56 ` [PATCH 11/12] netfilter: udplite proto sysctl support for net Gao feng
2012-04-17 2:56 ` [PATCH 12/12] netfilter: export necessary function for generic proto Gao feng
2012-04-17 9:01 ` Pablo Neira Ayuso
2012-04-17 8:52 ` [PATCH 00/12] add namespace support for netfilter protos Pablo Neira Ayuso
2012-04-17 10:12 ` Gao feng
2012-04-17 10:34 ` Jan Engelhardt
2012-04-17 10:59 ` Pablo Neira Ayuso [this message]
2012-04-17 14:35 ` Serge Hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120417105900.GA2765@1984 \
--to=pablo@netfilter.org \
--cc=dlezcano@fr.ibm.com \
--cc=ebiederm@xmission.com \
--cc=gaofeng@cn.fujitsu.com \
--cc=jengelh@medozas.de \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=serge.hallyn@canonical.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).