On 2013/7/29 17:48, Gao feng wrote:
> On 07/29/2013 10:31 AM, Rui Xiang wrote:
>> To containerise iptables log, use ns_printk
>> to report individual logs to container as
>> getting syslog_ns from skb->dev->nd_net->user_ns.
>>
>> Signed-off-by: Rui Xiang <rui.xiang@xxxxxxxxxx>
>> ---
>> include/net/netfilter/xt_log.h | 6 +++++-
>> net/netfilter/xt_LOG.c | 4 ++--
>> 2 files changed, 7 insertions(+), 3 deletions(-)
>>
>> diff --git a/include/net/netfilter/xt_log.h b/include/net/netfilter/xt_log.h
>> index 9d9756c..5222cba 100644
>> --- a/include/net/netfilter/xt_log.h
>> +++ b/include/net/netfilter/xt_log.h
>> @@ -39,10 +39,14 @@ static struct sbuff *sb_open(void)
>> return m;
>> }
>>
>> -static void sb_close(struct sbuff *m)
>> +static void sb_close(struct sbuff *m, struct sk_buff *skb)
>> {
>> m->buf[m->count] = 0;
>> +#ifdef CONFIG_NET_NS
>> + ns_printk(skb->dev->nd_net->user_ns->syslog_ns, "%s\n", m->buf);
>> +#else
>> printk("%s\n", m->buf);
>> +#endif
>>
>> if (likely(m != &emergency))
>> kfree(m);
>> diff --git a/net/netfilter/xt_LOG.c b/net/netfilter/xt_LOG.c
>> index 5ab2484..f2cd2fa3 100644
>> --- a/net/netfilter/xt_LOG.c
>> +++ b/net/netfilter/xt_LOG.c
>> @@ -493,7 +493,7 @@ ipt_log_packet(struct net *net,
>>
>> dump_ipv4_packet(m, loginfo, skb, 0);
>>
>> - sb_close(m);
>> + sb_close(m, skb);
>
>
> why don't you pass net directly to sb_close here?
>
> un init net namespace will not trigger any system log through ipt_LOG/ip6t_LOG.
> You can check the FIXME in ipt_log_packet.
>
> BTW,for this patch,you should cc netfilter-devel@xxxxxxxxxxxxxxx too.
>
Hi Gao,
Thanks for your attention.
Yes, you are right. In the 1st version, there was no net parameter in ipt_log_packet
function. Here I didn't do any amendment. And I will alter it in next version.
Thanks.
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/containers
