From: Gao feng <gaofeng@cn•fujitsu.com>
To: Pablo Neira Ayuso <pablo@netfilter•org>
Cc: netfilter-devel@vger•kernel.org, netdev@vger•kernel.org,
serge.hallyn@canonical•com, ebiederm@xmission•com,
dlezcano@fr•ibm.com
Subject: Re: [PATCH v2 00/17] netfilter: add namespace support for netfilter protos
Date: Tue, 08 May 2012 08:53:56 +0800 [thread overview]
Message-ID: <4FA86EA4.6000903@cn.fujitsu.com> (raw)
In-Reply-To: <20120507231955.GA5716@1984>
Hi,Pablo
于 2012年05月08日 07:19, Pablo Neira Ayuso 写道:
> Hi,
>
> On Fri, Apr 27, 2012 at 05:37:47PM +0800, Gao feng wrote:
>> Currently the sysctl of netfilter proto is not isolated, so when
>> changing proto's sysctl in container will cause the host's sysctl
>> be changed too. it's not expected.
>>
>> This patch set adds the namespace support for netfilter protos.
>>
>> impletement four pernet_operations to register sysctl and initial
>> pernet data for proto.
>>
>> -ipv4_net_ops is used to register tcp4(compat),
>> udp4(compat),icmp(compat),ipv4(compat).
>> -ipv6_net_ops is used to register tcp6,udp6 and icmpv6.
>> -sctp_net_ops is used to register sctp4(compat) and sctp6.
>> -udplite_net_ops is used to register udplite4 and udplite6
>>
>> extern l[3,4]proto (sysctl) register functions to make them support
>> namespace.
>>
>> finailly add namespace support for cttimeout.
>>
>> Gao feng (17):
>> netfilter: add struct nf_proto_net for register l4proto sysctl
>> netfilter: add namespace support for l4proto
>> netfilter: add namespace support for l3proto
>> netfilter: add namespace support for l4proto_generic
>> netfilter: add namespace support for l4proto_tcp
>> netfilter: add namespace support for l4proto_udp
>> netfilter: add namespace support for l4proto_icmp
>> netfilter: add namespace support for l4proto_icmpv6
>> netfilter: add namespace support for l3proto_ipv4
>> netfilter: add namespace support for l3proto_ipv6
>> netfilter: add namespace support for l4proto_sctp
>> netfilter: add namespace support for l4proto_udplite
>> netfilter: adjust l4proto_dccp to the nf_conntrack_l4proto_register
>> netfilter: adjust l4proto_gre4 to the nf_conntrack_l4proto_register
>> netfilter: cleanup sysctl for l4proto and l3proto
>> netfilter: add namespace support for cttimeout
>> netfilter: cttimeout use pernet data of l4proto
>
> I've been having a look at this patchset several times since last
> week. The logic that it follows to split changes into patches is not
> correct. This breaks the compilation of my tree since patch 2 until
> the entire patchset is applied.
>
> This has to start by one patch that adds the basic infrastructure to
> register the layer 3 and 4 conntrack timeout per-net support and it
> prepares the per-protocol per-net support. This implies to
> propagate the minimal set of changes to make sure it compiles, ie.
> modify clients to use the new interface to register init_net.
>
> Then, follow-up per-protocol patches that use the new infrastructure
> implement the per-protocol support. All this without breaking the
> compilation of my tree between patches.
Okay,I will fix this as you said,and do you have some comments about
the logic of this patchset?
>
> I'm all for fixing the existing unfinished container support for
> Netfilter, but this needs to be done appropriately.
I'm happy to see this.
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger•kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
prev parent reply other threads:[~2012-05-08 0:53 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-04-27 9:37 [PATCH v2 00/17] netfilter: add namespace support for netfilter protos Gao feng
2012-04-27 9:37 ` [PATCH 01/17] netfilter: add struct nf_proto_net for register l4proto sysctl Gao feng
2012-04-27 9:37 ` [PATCH 02/17] netfilter: add namespace support for l4proto Gao feng
2012-04-27 9:37 ` [PATCH 03/17] netfilter: add namespace support for l3proto Gao feng
2012-04-27 9:37 ` [PATCH 04/17] netfilter: add namespace support for l4proto_generic Gao feng
2012-04-27 9:37 ` [PATCH 05/17] netfilter: add namespace support for l4proto_tcp Gao feng
2012-04-27 9:37 ` [PATCH 06/17] netfilter: add namespace support for l4proto_udp Gao feng
2012-04-27 9:37 ` [PATCH 07/17] netfilter: add namespace support for l4proto_icmp Gao feng
2012-04-27 9:37 ` [PATCH 08/17] netfilter: add namespace support for l4proto_icmpv6 Gao feng
2012-04-27 9:37 ` [PATCH 09/17] netfilter: add namespace support for l3proto_ipv4 Gao feng
2012-04-27 9:37 ` [PATCH 10/17] netfilter: add namespace support for l3proto_ipv6 Gao feng
2012-04-27 9:37 ` [PATCH 11/17] netfilter: add namespace support for l4proto_sctp Gao feng
2012-04-27 9:37 ` [PATCH 12/17] netfilter: add namespace support for l4proto_udplite Gao feng
2012-04-27 9:38 ` [PATCH 13/17] netfilter: adjust l4proto_dccp to the nf_conntrack_l4proto_register Gao feng
2012-04-27 9:38 ` [PATCH 14/17] netfilter: adjust l4proto_gre4 " Gao feng
2012-04-27 9:38 ` [PATCH 15/17] netfilter: cleanup sysctl for l4proto and l3proto Gao feng
2012-04-27 9:38 ` [PATCH 16/17] netfilter: add namespace support for cttimeout Gao feng
2012-04-27 9:38 ` [PATCH 17/17] netfilter: cttimeout use pernet data of l4proto Gao feng
2012-05-01 18:47 ` [PATCH v2 00/17] netfilter: add namespace support for netfilter protos Eric W. Biederman
2012-05-02 0:40 ` Pablo Neira Ayuso
2012-05-07 23:19 ` Pablo Neira Ayuso
2012-05-08 0:53 ` Gao feng [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4FA86EA4.6000903@cn.fujitsu.com \
--to=gaofeng@cn$(echo .)fujitsu.com \
--cc=dlezcano@fr$(echo .)ibm.com \
--cc=ebiederm@xmission$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=netfilter-devel@vger$(echo .)kernel.org \
--cc=pablo@netfilter$(echo .)org \
--cc=serge.hallyn@canonical$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox