tree 5a7315c5f98fab6c2c8d52fb8615f6b64d2f2b19
parent fd390c35b35f0b87b538e6ce8f04a5e05bc536f0
author Christian Brauner <christian@brauner.io> 1540820784 +0100
committer Christian Brauner <christian@brauner.io> 1541591333 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE7btrcuORLb1XUhEwjrBW1T7ssS0FAlvi0ecACgkQjrBW1T7s
 sS0ROA//ZQ3q1vYdutvRp+JDtDzGC1UQH2rRalDZvH0Y9C+zGxZB/CFpHs9vigqV
 pAGGN+D3+6wogACwWpJJbIDVBTHGpbUYIUPusLLPtjPhw18hjTs0W97sZB60QEsR
 +iI3LdijCuk54vOsVgi7fablDugYJFZJOajS2J1OLuvXO9fdpww423tnfUYdkK0k
 r+FAJs5YXF2DOvoKp3MhbRQ7lKKqTUIkY3rMbeXcHfB+R78qjtqWtRvr0lrYEZgB
 dWS2gyWGv+57zDT59pwhQcoJZ1iXC+sTWUHhj3jUrSo8wwaOJX9tNDKIBoY6GEvc
 bnFfbVAWGjkhv0JtUI5LbVuvTy39cJCSefF5Yq8Nhku4F8nX9+cZkvFtYFtq31f1
 upKa7YPGg+SzLVffFOI0RjntFF+RJD3XKh+MTx4wLZSagQxORt0NJiPr43yy1KAt
 nnx+2IY5WCuh++wJnl4bjjCXoQ6RdqOTLIlfJ72uQJ8m4H7cWJbywGDzZW5RJ1ef
 utWur9lTAfsTb+fERsegl+D5fZR8l9xI79e2SrqoJXCP027SkvysJfkaxq1fwPeM
 PMZ0OeUtWBifS8zryyTmcr2AQ3BDJ45f2yGGeEo2m7OpxsxYd7i8pD2lLmUrTyin
 dnJa5WfdyMYyxHmst/SuU7cWpMr9/Yig4si34GWBGcJHC/yshiY=
 =oDZ9
 -----END PGP SIGNATURE-----

br_netfilter: namespace bridge netfilter sysctls

Currently, the /proc/sys/net/bridge folder is only created in the initial
network namespace. This patch ensures that the /proc/sys/net/bridge folder
is available in each network namespace if the module is loaded and
disappears from all network namespaces when the module is unloaded.

In doing so the patch makes the sysctls:

bridge-nf-call-arptables
bridge-nf-call-ip6tables
bridge-nf-call-iptables
bridge-nf-filter-pppoe-tagged
bridge-nf-filter-vlan-tagged
bridge-nf-pass-vlan-input-dev

apply per network namespace. This unblocks some use-cases where users would
like to e.g. not do bridge filtering for bridges in a specific network
namespace while doing so for bridges located in another network namespace.

The netfilter rules are afaict already per network namespace so it should
be safe for users to specify whether bridge devices inside a network
namespace are supposed to go through iptables et al. or not. Also, this can
already be done per-bridge by setting an option for each individual bridge
via Netlink. It should also be possible to do this for all bridges in a
network namespace via sysctls.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Reviewed-by: Tyler Hicks <tyhicks@canonical.com>