linux-kernel - Re: [PATCH 9/9] netfilter: use ns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 29 Jul 2013 20:37:26 +0800
From:	Rui Xiang <rui.xiang@...wei.com>
To:	Gao feng <gaofeng@...fujitsu.com>
CC:	<containers@...ts.linux-foundation.org>,
	<linux-kernel@...r.kernel.org>, <serge.hallyn@...ntu.com>,
	<ebiederm@...ssion.com>, <akpm@...ux-foundation.org>,
	<libo.chen@...wei.com>
Subject: Re: [PATCH 9/9] netfilter: use ns_printk in iptable context

On 2013/7/29 17:48, Gao feng wrote:
> On 07/29/2013 10:31 AM, Rui Xiang wrote:
>> To containerise iptables log, use ns_printk
>> to report individual logs to container as
>> getting syslog_ns from skb->dev->nd_net->user_ns.
>>
>> Signed-off-by: Rui Xiang <rui.xiang@...wei.com>
>> ---
>>  include/net/netfilter/xt_log.h | 6 +++++-
>>  net/netfilter/xt_LOG.c         | 4 ++--
>>  2 files changed, 7 insertions(+), 3 deletions(-)
>>
>> diff --git a/include/net/netfilter/xt_log.h b/include/net/netfilter/xt_log.h
>> index 9d9756c..5222cba 100644
>> --- a/include/net/netfilter/xt_log.h
>> +++ b/include/net/netfilter/xt_log.h
>> @@ -39,10 +39,14 @@ static struct sbuff *sb_open(void)
>>  	return m;
>>  }
>>  
>> -static void sb_close(struct sbuff *m)
>> +static void sb_close(struct sbuff *m, struct sk_buff *skb)
>>  {
>>  	m->buf[m->count] = 0;
>> +#ifdef CONFIG_NET_NS
>> +	ns_printk(skb->dev->nd_net->user_ns->syslog_ns, "%s\n", m->buf);
>> +#else
>>  	printk("%s\n", m->buf);
>> +#endif
>>  
>>  	if (likely(m != &emergency))
>>  		kfree(m);
>> diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
>> index 5ab2484..f2cd2fa3 100644
>> --- a/net/netfilter/xt_LOG.c
>> +++ b/net/netfilter/xt_LOG.c
>> @@ -493,7 +493,7 @@ ipt_log_packet(struct net *net,
>>  
>>  	dump_ipv4_packet(m, loginfo, skb, 0);
>>  
>> -	sb_close(m);
>> +	sb_close(m, skb);
> 
> 
> why don't you pass net directly to sb_close here?
> 
> un init net namespace will not trigger any system log through ipt_LOG/ip6t_LOG.
> You can check the FIXME in ipt_log_packet.
> 
> BTW,for this patch,you should cc netfilter-devel@...r.kernel.org too.
> 
Hi Gao,

Thanks for your attention.

Yes, you are right. In the 1st version, there was no net parameter in ipt_log_packet
function. Here I didn't do any amendment. And I will alter it in next version.



Thanks.


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/