Commit 2851940f authored by Michal Kubeček's avatar Michal Kubeček Committed by Pablo Neira Ayuso
Browse files

netfilter: allow logging from non-init namespaces 



Commit 69b34fb9 ("netfilter: xt_LOG: add net namespace support for
xt_LOG") disabled logging packets using the LOG target from non-init
namespaces. The motivation was to prevent containers from flooding
kernel log of the host. The plan was to keep it that way until syslog
namespace implementation allows containers to log in a safe way.

However, the work on syslog namespace seems to have hit a dead end
somewhere in 2013 and there are users who want to use xt_LOG in all
network namespaces. This patch allows to do so by setting

  /proc/sys/net/netfilter/nf_log_all_netns

to a nonzero value. This sysctl is only accessible from init_net so that
one cannot switch the behaviour from inside a container.

Signed-off-by: default avatarMichal Kubecek <mkubecek@suse.cz>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 90c1aff7

Documentation/networking/netfilter-sysctl.txt

0 → 100644
+10 −0
Original line number Diff line number Diff line 
/proc/sys/net/netfilter/* Variables:



nf_log_all_netns - BOOLEAN

	0 - disabled (default)

	not 0 - enabled



	By default, only init_net namespace can log packets into kernel log

	with LOG target; this aims to prevent containers from flooding host

	kernel log. If enabled, this target also works in other network

	namespaces. This variable is only accessible from init_net.

include/net/netfilter/nf_log.h

+3 −0
Original line number Diff line number Diff line
@@ -51,6 +51,9 @@ struct nf_logger { 
	struct module		*me;

};



/* sysctl_nf_log_all_netns - allow LOG target in all network namespaces */

extern int sysctl_nf_log_all_netns;



/* Function to register/unregister log function. */

int nf_log_register(u_int8_t pf, struct nf_logger *logger);

void nf_log_unregister(struct nf_logger *logger);

net/bridge/netfilter/ebt_log.c

+1 −1
Original line number Diff line number Diff line
@@ -78,7 +78,7 @@ ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum, 
	unsigned int bitmask;



	/* FIXME: Disabled from containers until syslog ns is supported */

	if (!net_eq(net, &init_net))

	if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)

		return;



	spin_lock_bh(&ebt_log_lock);

net/ipv4/netfilter/nf_log_arp.c

+1 −1
Original line number Diff line number Diff line
@@ -87,7 +87,7 @@ static void nf_log_arp_packet(struct net *net, u_int8_t pf, 
	struct nf_log_buf *m;



	/* FIXME: Disabled from containers until syslog ns is supported */

	if (!net_eq(net, &init_net))

	if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)

		return;



	m = nf_log_buf_open();

net/ipv4/netfilter/nf_log_ipv4.c

+1 −1
Original line number Diff line number Diff line
@@ -319,7 +319,7 @@ static void nf_log_ip_packet(struct net *net, u_int8_t pf, 
	struct nf_log_buf *m;



	/* FIXME: Disabled from containers until syslog ns is supported */

	if (!net_eq(net, &init_net))

	if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)

		return;



	m = nf_log_buf_open();

CRA Git | Maintained and supported by SUSTech CRA and CCSE