Vasily Averin schreef op 12/05/2014 22:11:
On 05/12/2014 11:04 PM, Bart De Schuymer wrote:
Vasily Averin schreef op 12/05/2014 18:32:
pernet_operations creates per-netns copy of common structure for sysctl flags
and initialize it values taken from init_brnf_net.
Signed-off-by: Vasily Averin <vvs@xxxxxxxxxx>
+static int __net_init brnf_net_init(struct net *net)
+{
+ struct brnf_net *bn = brnf_net(net);
+
+ memcpy(bn, &init_brnf_net, sizeof(struct brnf_net));
+ bn->net = net;
+ return brnf_sysctl_net_register(bn);
This does introduce a bit of backwards incompatibility (easily fixed
by adapting scripts), but this is really unavoidable when
transforming an existing global configuration to a per-netns
configuration. I'm ok with it.
Could you please explain, which backward incompatibility you mean here?
Nobody changes values init_brnf_net,
init_net have own copy, like any other network namespaces.
Well, init_brnf_net is never written to, so it keeps the default flags.
If a new netns is created, a copy of the contents of init_brnf_net is
made. So, whenever a netns is created, it starts with the default flags
(e.g. brnf_call_iptables is always 1 for a newly created netns).
In the current kernel, when a new netns is created, the configuration of
the main netns is used (the proc system doesn't even show the flags in
the created netns): if brnf_call_iptables is 0 before the new netns is
created, iptables won't see bridged IP traffic in the new netns.
With your patch, this behaviour will change.
It's possible to alter your patch to keep the same behaviour as before
at netns creation, but always starting from the same defaults is cleaner.
cheers,
Bart
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
