netfilter: nf_log_syslog: Consolidate entry checks

Every syslog logging callback has to perform the same check to cover for
rogue containers, introduce a helper for clarity. Drop the FIXME as
there is a viable solution since commit 2851940ffee31 ("netfilter: allow
logging from non-init namespaces").

Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_log_syslog.c b/net/netfilter/nf_log_syslog.c
index a7ff6fd..77bcb10 100644 (file)
--- a/net/netfilter/nf_log_syslog.c
+++ b/net/netfilter/nf_log_syslog.c
@@ -40,6 +40,12 @@ struct arppayload {
        unsigned char ip_dst[4];
 };
 
+/* Guard against containers flooding syslog. */
+static bool nf_log_allowed(const struct net *net)
+{
+       return net_eq(net, &init_net) || sysctl_nf_log_all_netns;
+}
+
 static void nf_log_dump_vlan(struct nf_log_buf *m, const struct sk_buff *skb)
 {
        u16 vid;
@@ -133,8 +139,7 @@ static void nf_log_arp_packet(struct net *net, u_int8_t pf,
 {
        struct nf_log_buf *m;
 
-       /* FIXME: Disabled from containers until syslog ns is supported */
-       if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)
+       if (!nf_log_allowed(net))
                return;
 
        m = nf_log_buf_open();
@@ -831,8 +836,7 @@ static void nf_log_ip_packet(struct net *net, u_int8_t pf,
 {
        struct nf_log_buf *m;
 
-       /* FIXME: Disabled from containers until syslog ns is supported */
-       if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)
+       if (!nf_log_allowed(net))
                return;
 
        m = nf_log_buf_open();
@@ -867,8 +871,7 @@ static void nf_log_ip6_packet(struct net *net, u_int8_t pf,
 {
        struct nf_log_buf *m;
 
-       /* FIXME: Disabled from containers until syslog ns is supported */
-       if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)
+       if (!nf_log_allowed(net))
                return;
 
        m = nf_log_buf_open();
@@ -904,8 +907,7 @@ static void nf_log_unknown_packet(struct net *net, u_int8_t pf,
 {
        struct nf_log_buf *m;
 
-       /* FIXME: Disabled from containers until syslog ns is supported */
-       if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)
+       if (!nf_log_allowed(net))
                return;
 
        m = nf_log_buf_open();