Commit c3e34866 authored by Phil Sutter's avatar Phil Sutter Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_log_syslog: Consolidate entry checks 



Every syslog logging callback has to perform the same check to cover for
rogue containers, introduce a helper for clarity. Drop the FIXME as
there is a viable solution since commit 2851940f ("netfilter: allow
logging from non-init namespaces").

Suggested-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0c878380

net/netfilter/nf_log_syslog.c

+10 −8
Original line number Diff line number Diff line
@@ -40,6 +40,12 @@ struct arppayload { 
	unsigned char ip_dst[4];

};



/* Guard against containers flooding syslog. */

static bool nf_log_allowed(const struct net *net)

{

	return net_eq(net, &init_net) || sysctl_nf_log_all_netns;

}



static void nf_log_dump_vlan(struct nf_log_buf *m, const struct sk_buff *skb)

{

	u16 vid;
@@ -133,8 +139,7 @@ static void nf_log_arp_packet(struct net *net, u_int8_t pf, 
{

	struct nf_log_buf *m;



	/* FIXME: Disabled from containers until syslog ns is supported */

	if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)

	if (!nf_log_allowed(net))

		return;



	m = nf_log_buf_open();
@@ -831,8 +836,7 @@ static void nf_log_ip_packet(struct net *net, u_int8_t pf, 
{

	struct nf_log_buf *m;



	/* FIXME: Disabled from containers until syslog ns is supported */

	if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)

	if (!nf_log_allowed(net))

		return;



	m = nf_log_buf_open();
@@ -867,8 +871,7 @@ static void nf_log_ip6_packet(struct net *net, u_int8_t pf, 
{

	struct nf_log_buf *m;



	/* FIXME: Disabled from containers until syslog ns is supported */

	if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)

	if (!nf_log_allowed(net))

		return;



	m = nf_log_buf_open();
@@ -904,8 +907,7 @@ static void nf_log_unknown_packet(struct net *net, u_int8_t pf, 
{

	struct nf_log_buf *m;



	/* FIXME: Disabled from containers until syslog ns is supported */

	if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)

	if (!nf_log_allowed(net))

		return;



	m = nf_log_buf_open();