| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 08 May 2012 08:53:56 +0800 From: Gao feng <gaofeng@...fujitsu.com> To: Pablo Neira Ayuso <pablo@...filter.org> CC: netfilter-devel@...r.kernel.org, netdev@...r.kernel.org, serge.hallyn@...onical.com, ebiederm@...ssion.com, dlezcano@...ibm.com Subject: Re: [PATCH v2 00/17] netfilter: add namespace support for netfilter protos Hi,Pablo 于 2012年05月08日 07:19, Pablo Neira Ayuso 写道: > Hi, > > On Fri, Apr 27, 2012 at 05:37:47PM +0800, Gao feng wrote: >> Currently the sysctl of netfilter proto is not isolated, so when >> changing proto's sysctl in container will cause the host's sysctl >> be changed too. it's not expected. >> >> This patch set adds the namespace support for netfilter protos. >> >> impletement four pernet_operations to register sysctl and initial >> pernet data for proto. >> >> -ipv4_net_ops is used to register tcp4(compat), >> udp4(compat),icmp(compat),ipv4(compat). >> -ipv6_net_ops is used to register tcp6,udp6 and icmpv6. >> -sctp_net_ops is used to register sctp4(compat) and sctp6. >> -udplite_net_ops is used to register udplite4 and udplite6 >> >> extern l[3,4]proto (sysctl) register functions to make them support >> namespace. >> >> finailly add namespace support for cttimeout. >> >> Gao feng (17): >> netfilter: add struct nf_proto_net for register l4proto sysctl >> netfilter: add namespace support for l4proto >> netfilter: add namespace support for l3proto >> netfilter: add namespace support for l4proto_generic >> netfilter: add namespace support for l4proto_tcp >> netfilter: add namespace support for l4proto_udp >> netfilter: add namespace support for l4proto_icmp >> netfilter: add namespace support for l4proto_icmpv6 >> netfilter: add namespace support for l3proto_ipv4 >> netfilter: add namespace support for l3proto_ipv6 >> netfilter: add namespace support for l4proto_sctp >> netfilter: add namespace support for l4proto_udplite >> netfilter: adjust l4proto_dccp to the nf_conntrack_l4proto_register >> netfilter: adjust l4proto_gre4 to the nf_conntrack_l4proto_register >> netfilter: cleanup sysctl for l4proto and l3proto >> netfilter: add namespace support for cttimeout >> netfilter: cttimeout use pernet data of l4proto > > I've been having a look at this patchset several times since last > week. The logic that it follows to split changes into patches is not > correct. This breaks the compilation of my tree since patch 2 until > the entire patchset is applied. > > This has to start by one patch that adds the basic infrastructure to > register the layer 3 and 4 conntrack timeout per-net support and it > prepares the per-protocol per-net support. This implies to > propagate the minimal set of changes to make sure it compiles, ie. > modify clients to use the new interface to register init_net. > > Then, follow-up per-protocol patches that use the new infrastructure > implement the per-protocol support. All this without breaking the > compilation of my tree between patches. Okay,I will fix this as you said,and do you have some comments about the logic of this patchset? > > I'm all for fixing the existing unfinished container support for > Netfilter, but this needs to be done appropriately. I'm happy to see this. > -- > To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in > the body of a message to majordomo@...r.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists