Re: [PATCH v2 nf-next 0/9] netfilter: don't copy initns hooks to new namespaces

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Florian,

On Fri, Oct 23, 2015 at 12:43:17PM +0200, Florian Westphal wrote:
[...]
> This work aims to change all major hook users to nf_register_net_hook
> so that when a new netns is created it has no hooks at all, even when the
> initial namespace uses conntrack, iptables and bridge netfilter.
>
> To keep behaviour somewhat compatible, xtable hooks are registered once a
> iptables set/getsockopt call is made within a net namespace.
> This also means that e.g. conntrack behaviour is not yet optimal, we
> still create all the data structures and only skip hook registration
> at this time.
> 
> Caveats:
> - conntrack is no longer active just by loading nf_conntrack module -- at
> least one (x)tables rule that requires conntrack has to be added, e.g.
> conntrack match or S/DNAT target.

So far it was possible to run conntrack without iptables, eg. to
collect statistics at per-flow level via ctnetlink. Could you find a
way to enable the hooks also from that path?

If the program polls /proc, too bad for it, it shouldn't be using such
interface for that purpose.

We probably should go back to the idea of having an explicit way of
enabling conntrack from the ruleset, but that will need the /proc
switch to keep there the existing semantics that people expect.

Let me know,
Thanks.