linux-stable.git/include/net/netns, branch linux-2.6.25.y

[NETFILTER]: arp_tables: per-netns arp_tables FILTER

2008-02-01T03:27:41+00:00

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: ip6_tables: per-netns IPv6 FILTER, MANGLE, RAW

2008-02-01T03:27:39+00:00

Now it's possible to list and manipulate per-netns ip6tables rules.
Filtering decisions are based on init_net's table so far.

P.S.: remove init_net check in inet6_create() to see the effect

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: ip_tables: per-netns FILTER, MANGLE, RAW

2008-02-01T03:27:38+00:00

Now, iptables show and configure different set of rules in different
netnss'. Filtering decisions are still made by consulting only
init_net's set.

Changes are identical except naming so no splitting.

P.S.: one need to remove init_net checks in nf_sockopt.c and inet_create()
      to see the effect.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETFILTER]: x_tables: per-netns xt_tables

2008-02-01T03:27:35+00:00

In fact all we want is per-netns set of rules, however doing that will
unnecessary complicate routines such as ipt_hook()/ipt_do_table, so
make full xt_table array per-netns.

Every user stubbed with init_net for a while.

Signed-off-by: Alexey Dobriyan 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETNS][FRAGS]: Isolate the secret interval from namespaces.

2008-01-28T23:10:39+00:00

Since we have one hashtable to lookup the fragment, having
different secret_interval-s for hash rebuild doesn't make
sense, so move this one to inet_frags.

The inet_frags_ctl becomes empty after this, so remove it.
The appropriate ctl table is kept read-only in namespaces.

Signed-off-by: Pavel Emelyanov 
Signed-off-by: David S. Miller

[NETNS][FRAGS]: Duplicate sysctl tables for new namespaces.

2008-01-28T23:10:37+00:00

Each namespace has to have own tables to tune their
different parameters, so duplicate the tables and
register them.

All the tables in sub-namespaces are temporarily made
read-only.

Signed-off-by: Pavel Emelyanov 
Signed-off-by: David S. Miller

[NETNS][FRAGS]: Make the inet_frag_queue lookup work in namespaces.

2008-01-28T23:10:34+00:00

Since fragment management code is consolidated, we cannot have the
pointer from inet_frag_queue to struct net, since we must know what
king of fragment this is.

So, I introduce the netns_frags structure. This one is currently
empty, but will be eventually filled with per-namespace
attributes. Each inet_frag_queue is tagged with this one.

The conntrack_reasm is not "netns-izated", so it has one static
netns_frags instance to keep working in init namespace.

Signed-off-by: Pavel Emelyanov 
Signed-off-by: David S. Miller

[NETNS]: Create ipv6 devconf-s for namespaces

2008-01-28T23:01:40+00:00

This is the core. Declare and register the pernet subsys for
addrconf. The init callback the will create the devconf-s.

The init_net will reuse the existing statically declared confs,
so that accessing them from inside the ipv6 code will still
work.

The register_pernet_subsys() is moved above the ipv6_add_dev()
call for loopback, because this function will need the
net->devconf_dflt pointer to be already set.

Signed-off-by: Pavel Emelyanov 
Signed-off-by: David S. Miller

[NETNS]: Provide correct namespace for fibnl netlink socket.

2008-01-28T23:01:32+00:00

This patch makes the netlink socket to be per namespace. That allows
to have each namespace its own socket for routing queries.

Acked-by: Benjamin Thery 
Acked-by: Daniel Lezcano 
Signed-off-by: Denis V. Lunev 
Signed-off-by: David S. Miller

[NETNS]: Place fib tables into netns.

2008-01-28T23:01:31+00:00

The preparatory work has been done. All we need is to substitute
fib_table_hash with net->ipv4.fib_table_hash. Netns context is
available when required.

Acked-by: Benjamin Thery 
Acked-by: Daniel Lezcano 
Signed-off-by: Denis V. Lunev 
Signed-off-by: David S. Miller