* [PATCH nf-next 1/6] ipt_CLUSTERIP: make proc directory per net namespace
2013-09-25 7:38 [PATCH nf-next 0/6] Add net namespace support for ipt_CLUSTERIP Gao feng
@ 2013-09-25 7:38 ` Gao feng
2013-09-25 7:38 ` [PATCH nf-next 2/6] ipt_CLUSTERIP: make clusterip_list " Gao feng
` (5 subsequent siblings)
6 siblings, 0 replies; 10+ messages in thread
From: Gao feng @ 2013-09-25 7:38 UTC (permalink / raw)
To: netfilter-devel; +Cc: Gao feng
Create /proc/net/ipt_CLUSTERIP directory for per net namespace.
Right now,only allow to create entries under the ipt_CLUSTERIP
in init net namespace.
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 70 +++++++++++++++++++++++++++-----------
1 file changed, 51 insertions(+), 19 deletions(-)
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 0b732ef..e66b91b 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -28,6 +28,7 @@
#include <linux/netfilter_ipv4/ipt_CLUSTERIP.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/net_namespace.h>
+#include <net/netns/generic.h>
#include <net/checksum.h>
#include <net/ip.h>
@@ -64,9 +65,16 @@ static DEFINE_SPINLOCK(clusterip_lock);
#ifdef CONFIG_PROC_FS
static const struct file_operations clusterip_proc_fops;
-static struct proc_dir_entry *clusterip_procdir;
#endif
+static int clusterip_net_id __read_mostly;
+
+struct clusterip_net {
+#ifdef CONFIG_PROC_FS
+ struct proc_dir_entry *procdir;
+#endif
+};
+
static inline void
clusterip_config_get(struct clusterip_config *c)
{
@@ -158,6 +166,7 @@ clusterip_config_init(const struct ipt_clusterip_tgt_info *i, __be32 ip,
struct net_device *dev)
{
struct clusterip_config *c;
+ struct clusterip_net *cn = net_generic(&init_net, clusterip_net_id);
c = kzalloc(sizeof(*c), GFP_ATOMIC);
if (!c)
@@ -180,7 +189,7 @@ clusterip_config_init(const struct ipt_clusterip_tgt_info *i, __be32 ip,
/* create proc dir entry */
sprintf(buffer, "%pI4", &ip);
c->pde = proc_create_data(buffer, S_IWUSR|S_IRUSR,
- clusterip_procdir,
+ cn->procdir,
&clusterip_proc_fops, c);
if (!c->pde) {
kfree(c);
@@ -698,48 +707,71 @@ static const struct file_operations clusterip_proc_fops = {
#endif /* CONFIG_PROC_FS */
+static int clusterip_net_init(struct net *net)
+{
+#ifdef CONFIG_PROC_FS
+ struct clusterip_net *cn = net_generic(net, clusterip_net_id);
+
+ cn->procdir = proc_mkdir("ipt_CLUSTERIP", net->proc_net);
+ if (!cn->procdir) {
+ pr_err("Unable to proc dir entry\n");
+ return -ENOMEM;
+ }
+#endif /* CONFIG_PROC_FS */
+
+ return 0;
+}
+
+static void clusterip_net_exit(struct net *net)
+{
+#ifdef CONFIG_PROC_FS
+ struct clusterip_net *cn = net_generic(net, clusterip_net_id);
+ proc_remove(cn->procdir);
+#endif
+}
+
+static struct pernet_operations clusterip_net_ops = {
+ .init = clusterip_net_init,
+ .exit = clusterip_net_exit,
+ .id = &clusterip_net_id,
+ .size = sizeof(struct clusterip_net),
+};
+
static int __init clusterip_tg_init(void)
{
int ret;
- ret = xt_register_target(&clusterip_tg_reg);
+ ret = register_pernet_subsys(&clusterip_net_ops);
if (ret < 0)
return ret;
+ ret = xt_register_target(&clusterip_tg_reg);
+ if (ret < 0)
+ goto cleanup_subsys;
+
ret = nf_register_hook(&cip_arp_ops);
if (ret < 0)
goto cleanup_target;
-#ifdef CONFIG_PROC_FS
- clusterip_procdir = proc_mkdir("ipt_CLUSTERIP", init_net.proc_net);
- if (!clusterip_procdir) {
- pr_err("Unable to proc dir entry\n");
- ret = -ENOMEM;
- goto cleanup_hook;
- }
-#endif /* CONFIG_PROC_FS */
-
pr_info("ClusterIP Version %s loaded successfully\n",
CLUSTERIP_VERSION);
+
return 0;
-#ifdef CONFIG_PROC_FS
-cleanup_hook:
- nf_unregister_hook(&cip_arp_ops);
-#endif /* CONFIG_PROC_FS */
cleanup_target:
xt_unregister_target(&clusterip_tg_reg);
+cleanup_subsys:
+ unregister_pernet_subsys(&clusterip_net_ops);
return ret;
}
static void __exit clusterip_tg_exit(void)
{
pr_info("ClusterIP Version %s unloading\n", CLUSTERIP_VERSION);
-#ifdef CONFIG_PROC_FS
- proc_remove(clusterip_procdir);
-#endif
+
nf_unregister_hook(&cip_arp_ops);
xt_unregister_target(&clusterip_tg_reg);
+ unregister_pernet_subsys(&clusterip_net_ops);
/* Wait for completion of call_rcu_bh()'s (clusterip_config_rcu_free) */
rcu_barrier_bh();
--
1.8.3.1
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH nf-next 2/6] ipt_CLUSTERIP: make clusterip_list per net namespace
2013-09-25 7:38 [PATCH nf-next 0/6] Add net namespace support for ipt_CLUSTERIP Gao feng
2013-09-25 7:38 ` [PATCH nf-next 1/6] ipt_CLUSTERIP: make proc directory per net namespace Gao feng
@ 2013-09-25 7:38 ` Gao feng
2013-09-25 7:38 ` [PATCH nf-next 3/6] ipt_CLUSTERIP: make clusterip_lock " Gao feng
` (4 subsequent siblings)
6 siblings, 0 replies; 10+ messages in thread
From: Gao feng @ 2013-09-25 7:38 UTC (permalink / raw)
To: netfilter-devel; +Cc: Gao feng
clusterip_configs should be per net namespace, so operate
cluster in one net namespace won't affect other net
namespace. right now, only allow to operate the clusterip_configs
of init net namespace.
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index e66b91b..8ef3e6f 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -58,8 +58,6 @@ struct clusterip_config {
struct rcu_head rcu;
};
-static LIST_HEAD(clusterip_configs);
-
/* clusterip_lock protects the clusterip_configs list */
static DEFINE_SPINLOCK(clusterip_lock);
@@ -70,6 +68,7 @@ static const struct file_operations clusterip_proc_fops;
static int clusterip_net_id __read_mostly;
struct clusterip_net {
+ struct list_head configs;
#ifdef CONFIG_PROC_FS
struct proc_dir_entry *procdir;
#endif
@@ -124,8 +123,9 @@ static struct clusterip_config *
__clusterip_config_find(__be32 clusterip)
{
struct clusterip_config *c;
+ struct clusterip_net *cn = net_generic(&init_net, clusterip_net_id);
- list_for_each_entry_rcu(c, &clusterip_configs, list) {
+ list_for_each_entry_rcu(c, &cn->configs, list) {
if (c->clusterip == clusterip)
return c;
}
@@ -199,7 +199,7 @@ clusterip_config_init(const struct ipt_clusterip_tgt_info *i, __be32 ip,
#endif
spin_lock_bh(&clusterip_lock);
- list_add_rcu(&c->list, &clusterip_configs);
+ list_add_rcu(&c->list, &cn->configs);
spin_unlock_bh(&clusterip_lock);
return c;
@@ -709,9 +709,11 @@ static const struct file_operations clusterip_proc_fops = {
static int clusterip_net_init(struct net *net)
{
-#ifdef CONFIG_PROC_FS
struct clusterip_net *cn = net_generic(net, clusterip_net_id);
+ INIT_LIST_HEAD(&cn->configs);
+
+#ifdef CONFIG_PROC_FS
cn->procdir = proc_mkdir("ipt_CLUSTERIP", net->proc_net);
if (!cn->procdir) {
pr_err("Unable to proc dir entry\n");
--
1.8.3.1
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH nf-next 3/6] ipt_CLUSTERIP: make clusterip_lock per net namespace
2013-09-25 7:38 [PATCH nf-next 0/6] Add net namespace support for ipt_CLUSTERIP Gao feng
2013-09-25 7:38 ` [PATCH nf-next 1/6] ipt_CLUSTERIP: make proc directory per net namespace Gao feng
2013-09-25 7:38 ` [PATCH nf-next 2/6] ipt_CLUSTERIP: make clusterip_list " Gao feng
@ 2013-09-25 7:38 ` Gao feng
2013-09-25 7:38 ` [PATCH nf-next 4/6] ipt_CLUSTERIP: add parameter net in clusterip_config_find_get Gao feng
` (3 subsequent siblings)
6 siblings, 0 replies; 10+ messages in thread
From: Gao feng @ 2013-09-25 7:38 UTC (permalink / raw)
To: netfilter-devel; +Cc: Gao feng
this lock is used for protecting clusterip_configs of per
net namespace, it should be per net namespace too.
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 8ef3e6f..1bf5aa30 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -58,9 +58,6 @@ struct clusterip_config {
struct rcu_head rcu;
};
-/* clusterip_lock protects the clusterip_configs list */
-static DEFINE_SPINLOCK(clusterip_lock);
-
#ifdef CONFIG_PROC_FS
static const struct file_operations clusterip_proc_fops;
#endif
@@ -69,6 +66,9 @@ static int clusterip_net_id __read_mostly;
struct clusterip_net {
struct list_head configs;
+ /* lock protects the configs list */
+ spinlock_t lock;
+
#ifdef CONFIG_PROC_FS
struct proc_dir_entry *procdir;
#endif
@@ -99,10 +99,12 @@ clusterip_config_put(struct clusterip_config *c)
static inline void
clusterip_config_entry_put(struct clusterip_config *c)
{
+ struct clusterip_net *cn = net_generic(&init_net, clusterip_net_id);
+
local_bh_disable();
- if (atomic_dec_and_lock(&c->entries, &clusterip_lock)) {
+ if (atomic_dec_and_lock(&c->entries, &cn->lock)) {
list_del_rcu(&c->list);
- spin_unlock(&clusterip_lock);
+ spin_unlock(&cn->lock);
local_bh_enable();
dev_mc_del(c->dev, c->clustermac);
@@ -198,9 +200,9 @@ clusterip_config_init(const struct ipt_clusterip_tgt_info *i, __be32 ip,
}
#endif
- spin_lock_bh(&clusterip_lock);
+ spin_lock_bh(&cn->lock);
list_add_rcu(&c->list, &cn->configs);
- spin_unlock_bh(&clusterip_lock);
+ spin_unlock_bh(&cn->lock);
return c;
}
@@ -713,6 +715,8 @@ static int clusterip_net_init(struct net *net)
INIT_LIST_HEAD(&cn->configs);
+ spin_lock_init(&cn->lock);
+
#ifdef CONFIG_PROC_FS
cn->procdir = proc_mkdir("ipt_CLUSTERIP", net->proc_net);
if (!cn->procdir) {
--
1.8.3.1
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH nf-next 4/6] ipt_CLUSTERIP: add parameter net in clusterip_config_find_get
2013-09-25 7:38 [PATCH nf-next 0/6] Add net namespace support for ipt_CLUSTERIP Gao feng
` (2 preceding siblings ...)
2013-09-25 7:38 ` [PATCH nf-next 3/6] ipt_CLUSTERIP: make clusterip_lock " Gao feng
@ 2013-09-25 7:38 ` Gao feng
2013-09-25 7:38 ` [PATCH nf-next 5/6] ipt_CLUSTERIP: create proc entry under proper ipt_CLUSTERIP directory Gao feng
` (2 subsequent siblings)
6 siblings, 0 replies; 10+ messages in thread
From: Gao feng @ 2013-09-25 7:38 UTC (permalink / raw)
To: netfilter-devel; +Cc: Gao feng
Inorder to find clusterip_config in net namespace.
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 1bf5aa30..b7fc9d5 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -122,10 +122,10 @@ clusterip_config_entry_put(struct clusterip_config *c)
}
static struct clusterip_config *
-__clusterip_config_find(__be32 clusterip)
+__clusterip_config_find(struct net *net, __be32 clusterip)
{
struct clusterip_config *c;
- struct clusterip_net *cn = net_generic(&init_net, clusterip_net_id);
+ struct clusterip_net *cn = net_generic(net, clusterip_net_id);
list_for_each_entry_rcu(c, &cn->configs, list) {
if (c->clusterip == clusterip)
@@ -136,12 +136,12 @@ __clusterip_config_find(__be32 clusterip)
}
static inline struct clusterip_config *
-clusterip_config_find_get(__be32 clusterip, int entry)
+clusterip_config_find_get(struct net *net, __be32 clusterip, int entry)
{
struct clusterip_config *c;
rcu_read_lock_bh();
- c = __clusterip_config_find(clusterip);
+ c = __clusterip_config_find(net, clusterip);
if (c) {
if (unlikely(!atomic_inc_not_zero(&c->refcount)))
c = NULL;
@@ -381,7 +381,7 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
/* FIXME: further sanity checks */
- config = clusterip_config_find_get(e->ip.dst.s_addr, 1);
+ config = clusterip_config_find_get(&init_net, e->ip.dst.s_addr, 1);
if (!config) {
if (!(cipinfo->flags & CLUSTERIP_FLAG_NEW)) {
pr_info("no config found for %pI4, need 'new'\n",
@@ -519,7 +519,7 @@ arp_mangle(unsigned int hook,
/* if there is no clusterip configuration for the arp reply's
* source ip, we don't want to mangle it */
- c = clusterip_config_find_get(payload->src_ip, 0);
+ c = clusterip_config_find_get(&init_net, payload->src_ip, 0);
if (!c)
return NF_ACCEPT;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH nf-next 5/6] ipt_CLUSTERIP: create proc entry under proper ipt_CLUSTERIP directory
2013-09-25 7:38 [PATCH nf-next 0/6] Add net namespace support for ipt_CLUSTERIP Gao feng
` (3 preceding siblings ...)
2013-09-25 7:38 ` [PATCH nf-next 4/6] ipt_CLUSTERIP: add parameter net in clusterip_config_find_get Gao feng
@ 2013-09-25 7:38 ` Gao feng
2013-09-25 7:38 ` [PATCH nf-next 6/6] ipt_CLUSTERIP: use proper net namespace to operate CLUSTERIP Gao feng
2013-10-01 11:05 ` [PATCH nf-next 0/6] Add net namespace support for ipt_CLUSTERIP Pablo Neira Ayuso
6 siblings, 0 replies; 10+ messages in thread
From: Gao feng @ 2013-09-25 7:38 UTC (permalink / raw)
To: netfilter-devel; +Cc: Gao feng
Create proc entries under the ipt_CLUSTERIP directory of proper
net namespace.
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index b7fc9d5..c93dfd2 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -168,7 +168,7 @@ clusterip_config_init(const struct ipt_clusterip_tgt_info *i, __be32 ip,
struct net_device *dev)
{
struct clusterip_config *c;
- struct clusterip_net *cn = net_generic(&init_net, clusterip_net_id);
+ struct clusterip_net *cn = net_generic(dev_net(dev), clusterip_net_id);
c = kzalloc(sizeof(*c), GFP_ATOMIC);
if (!c)
--
1.8.3.1
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH nf-next 6/6] ipt_CLUSTERIP: use proper net namespace to operate CLUSTERIP
2013-09-25 7:38 [PATCH nf-next 0/6] Add net namespace support for ipt_CLUSTERIP Gao feng
` (4 preceding siblings ...)
2013-09-25 7:38 ` [PATCH nf-next 5/6] ipt_CLUSTERIP: create proc entry under proper ipt_CLUSTERIP directory Gao feng
@ 2013-09-25 7:38 ` Gao feng
2013-10-01 11:05 ` [PATCH nf-next 0/6] Add net namespace support for ipt_CLUSTERIP Pablo Neira Ayuso
6 siblings, 0 replies; 10+ messages in thread
From: Gao feng @ 2013-09-25 7:38 UTC (permalink / raw)
To: netfilter-devel; +Cc: Gao feng
we can allow users in uninit net namespace to operate ipt_CLUSTERIP
now.
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
net/ipv4/netfilter/ipt_CLUSTERIP.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index c93dfd2..ecd808a 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -99,7 +99,8 @@ clusterip_config_put(struct clusterip_config *c)
static inline void
clusterip_config_entry_put(struct clusterip_config *c)
{
- struct clusterip_net *cn = net_generic(&init_net, clusterip_net_id);
+ struct net *net = dev_net(c->dev);
+ struct clusterip_net *cn = net_generic(net, clusterip_net_id);
local_bh_disable();
if (atomic_dec_and_lock(&c->entries, &cn->lock)) {
@@ -381,7 +382,7 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
/* FIXME: further sanity checks */
- config = clusterip_config_find_get(&init_net, e->ip.dst.s_addr, 1);
+ config = clusterip_config_find_get(par->net, e->ip.dst.s_addr, 1);
if (!config) {
if (!(cipinfo->flags & CLUSTERIP_FLAG_NEW)) {
pr_info("no config found for %pI4, need 'new'\n",
@@ -395,7 +396,7 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
return -EINVAL;
}
- dev = dev_get_by_name(&init_net, e->ip.iniface);
+ dev = dev_get_by_name(par->net, e->ip.iniface);
if (!dev) {
pr_info("no such interface %s\n",
e->ip.iniface);
@@ -503,6 +504,7 @@ arp_mangle(unsigned int hook,
struct arphdr *arp = arp_hdr(skb);
struct arp_payload *payload;
struct clusterip_config *c;
+ struct net *net = dev_net(in ? in : out);
/* we don't care about non-ethernet and non-ipv4 ARP */
if (arp->ar_hrd != htons(ARPHRD_ETHER) ||
@@ -519,7 +521,7 @@ arp_mangle(unsigned int hook,
/* if there is no clusterip configuration for the arp reply's
* source ip, we don't want to mangle it */
- c = clusterip_config_find_get(&init_net, payload->src_ip, 0);
+ c = clusterip_config_find_get(net, payload->src_ip, 0);
if (!c)
return NF_ACCEPT;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH nf-next 0/6] Add net namespace support for ipt_CLUSTERIP
2013-09-25 7:38 [PATCH nf-next 0/6] Add net namespace support for ipt_CLUSTERIP Gao feng
` (5 preceding siblings ...)
2013-09-25 7:38 ` [PATCH nf-next 6/6] ipt_CLUSTERIP: use proper net namespace to operate CLUSTERIP Gao feng
@ 2013-10-01 11:05 ` Pablo Neira Ayuso
2013-10-04 8:51 ` Gao feng
6 siblings, 1 reply; 10+ messages in thread
From: Pablo Neira Ayuso @ 2013-10-01 11:05 UTC (permalink / raw)
To: Gao feng; +Cc: netfilter-devel
Hi Gao,
On Wed, Sep 25, 2013 at 03:38:43PM +0800, Gao feng wrote:
> This patchset adds net namespace support for ipt_CLUSTERIP,
> makes clusterip_configs,clusterip_lock and clusterip_procdir
> per net namespace, and allow users in container to operate
> the proper pernet resource of CLUSTERIP.
>
> Gao feng (6):
> ipt_CLUSTERIP: make proc directory per net namespace
> ipt_CLUSTERIP: make clusterip_list per net namespace
> ipt_CLUSTERIP: make clusterip_lock per net namespace
> ipt_CLUSTERIP: add parameter net in clusterip_config_find_get
> ipt_CLUSTERIP: create proc entry under proper ipt_CLUSTERIP directory
> ipt_CLUSTERIP: use proper net namespace to operate CLUSTERIP
CLUSTERIP is a subset of the cluster match. The cluster match allows
gateway configurations, which are not possible with CLUSTERIP.
If you really need these, I can take them. But I'd be happy if you can
check the cluster match to make sure there are no issue regarding net
namespaces.
Let me know.
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH nf-next 0/6] Add net namespace support for ipt_CLUSTERIP
2013-10-01 11:05 ` [PATCH nf-next 0/6] Add net namespace support for ipt_CLUSTERIP Pablo Neira Ayuso
@ 2013-10-04 8:51 ` Gao feng
2013-10-17 8:46 ` Pablo Neira Ayuso
0 siblings, 1 reply; 10+ messages in thread
From: Gao feng @ 2013-10-04 8:51 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
Hi Pablo,
On 10/01/2013 07:05 PM, Pablo Neira Ayuso wrote:
> Hi Gao,
>
> On Wed, Sep 25, 2013 at 03:38:43PM +0800, Gao feng wrote:
>> This patchset adds net namespace support for ipt_CLUSTERIP,
>> makes clusterip_configs,clusterip_lock and clusterip_procdir
>> per net namespace, and allow users in container to operate
>> the proper pernet resource of CLUSTERIP.
>>
>> Gao feng (6):
>> ipt_CLUSTERIP: make proc directory per net namespace
>> ipt_CLUSTERIP: make clusterip_list per net namespace
>> ipt_CLUSTERIP: make clusterip_lock per net namespace
>> ipt_CLUSTERIP: add parameter net in clusterip_config_find_get
>> ipt_CLUSTERIP: create proc entry under proper ipt_CLUSTERIP directory
>> ipt_CLUSTERIP: use proper net namespace to operate CLUSTERIP
>
> CLUSTERIP is a subset of the cluster match. The cluster match allows
> gateway configurations, which are not possible with CLUSTERIP.
Yes, but seems ipt_CLUSTERIP is more popular.(from the result I seach through google)
>
> If you really need these, I can take them. But I'd be happy if you can
> check the cluster match to make sure there are no issue regarding net
> namespaces.
>
I looked into the codes of cluster match module, and did some simple test,
it has no need to do with net namespace. works well in container :)
Thanks
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH nf-next 0/6] Add net namespace support for ipt_CLUSTERIP
2013-10-04 8:51 ` Gao feng
@ 2013-10-17 8:46 ` Pablo Neira Ayuso
0 siblings, 0 replies; 10+ messages in thread
From: Pablo Neira Ayuso @ 2013-10-17 8:46 UTC (permalink / raw)
To: Gao feng; +Cc: netfilter-devel
On Fri, Oct 04, 2013 at 04:51:39PM +0800, Gao feng wrote:
> Hi Pablo,
>
> On 10/01/2013 07:05 PM, Pablo Neira Ayuso wrote:
> > Hi Gao,
> >
> > On Wed, Sep 25, 2013 at 03:38:43PM +0800, Gao feng wrote:
> >> This patchset adds net namespace support for ipt_CLUSTERIP,
> >> makes clusterip_configs,clusterip_lock and clusterip_procdir
> >> per net namespace, and allow users in container to operate
> >> the proper pernet resource of CLUSTERIP.
> >>
> >> Gao feng (6):
> >> ipt_CLUSTERIP: make proc directory per net namespace
> >> ipt_CLUSTERIP: make clusterip_list per net namespace
> >> ipt_CLUSTERIP: make clusterip_lock per net namespace
> >> ipt_CLUSTERIP: add parameter net in clusterip_config_find_get
> >> ipt_CLUSTERIP: create proc entry under proper ipt_CLUSTERIP directory
> >> ipt_CLUSTERIP: use proper net namespace to operate CLUSTERIP
> >
> > CLUSTERIP is a subset of the cluster match. The cluster match allows
> > gateway configurations, which are not possible with CLUSTERIP.
>
> Yes, but seems ipt_CLUSTERIP is more popular.(from the result I seach through google)
Fair enough, applied to nf-next.
> > If you really need these, I can take them. But I'd be happy if you can
> > check the cluster match to make sure there are no issue regarding net
> > namespaces.
> >
>
> I looked into the codes of cluster match module, and did some simple test,
> it has no need to do with net namespace. works well in container :)
thanks a lot of checking Gao.
^ permalink raw reply [flat|nested] 10+ messages in thread