diff options
| author | Alexey Dobriyan <adobriyan@gmail.com> | 2008-10-08 11:35:11 +0200 |
|---|---|---|
| committer | Patrick McHardy <kaber@trash.net> | 2008-10-08 11:35:11 +0200 |
| commit | 4de6f16b9ec2422fa7ef9c22f7b1c8d5a55499b4 (patch) | |
| tree | bada7a75d6be807c3c4dca8b72ade88a98efcbce /net/netfilter/nf_sockopt.c | |
| parent | cfd6e3d74751b62b6d0844e24c911776e40a0135 (diff) | |
netfilter: enable netfilter in netns
From kernel perspective, allow entrance in nf_hook_slow().
Stuff which uses nf_register_hook/nf_register_hooks, but otherwise not netns-ready:
DECnet netfilter
ipt_CLUSTERIP
nf_nat_standalone.c together with XFRM (?)
IPVS
several individual match modules (like hashlimit)
ctnetlink
NOTRACK
all sorts of queueing and reporting to userspace
L3 and L4 protocol sysctls, bridge sysctls
probably something else
Anyway critical mass has been achieved, there is no reason to hide netfilter any longer.
From userspace perspective, allow to manipulate all sorts of
iptables/ip6tables/arptables rules.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Diffstat (limited to 'net/netfilter/nf_sockopt.c')
| -rw-r--r-- | net/netfilter/nf_sockopt.c | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/net/netfilter/nf_sockopt.c b/net/netfilter/nf_sockopt.c index f9b46de6a3d..8ab829f8657 100644 --- a/net/netfilter/nf_sockopt.c +++ b/net/netfilter/nf_sockopt.c @@ -65,9 +65,6 @@ static struct nf_sockopt_ops *nf_sockopt_find(struct sock *sk, u_int8_t pf, { struct nf_sockopt_ops *ops; - if (!net_eq(sock_net(sk), &init_net)) - return ERR_PTR(-ENOPROTOOPT); - if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0) return ERR_PTR(-EINTR); |