Skip to content
  • Eric W. Biederman's avatar
    netfilter: Per network namespace netfilter hooks. · 085db2c0
    Eric W. Biederman authored
    
    
    - Add a new set of functions for registering and unregistering per
      network namespace hooks.
    
    - Modify the old global namespace hook functions to use the per
      network namespace hooks in their implementation, so their remains a
      single list that needs to be walked for any hook (this is important
      for keeping the hook priority working and for keeping the code
      walking the hooks simple).
    
    - Only allow registering the per netdevice hooks in the network
      namespace where the network device lives.
    
    - Dynamically allocate the structures in the per network namespace
      hook list in nf_register_net_hook, and unregister them in
      nf_unregister_net_hook.
    
      Dynamic allocate is required somewhere as the number of network
      namespaces are not fixed so we might as well allocate them in the
      registration function.
    
      The chain of registered hooks on any list is expected to be small so
      the cost of walking that list to find the entry we are unregistering
      should also be small.
    
      Performing the management of the dynamically allocated list entries
      in the registration and unregistration functions keeps the complexity
      from spreading.
    
    Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
    085db2c0