From fbea445df472e2d9ee221c850d1a036cbecd59ef Mon Sep 17 00:00:00 2001 From: Andrey Vagin Date: Mon, 17 Sep 2012 20:05:49 +0400 Subject: [PATCH] cd-dump: lock connection with iptables rules only in a current netns For another netns we don't need to lock separate connections, an external chanel can be locked. Signed-off-by: Andrey Vagin Signed-off-by: Pavel Emelyanov --- sk-tcp.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/sk-tcp.c b/sk-tcp.c index f723834fa..1782d535f 100644 --- a/sk-tcp.c +++ b/sk-tcp.c @@ -67,9 +67,11 @@ static int tcp_repair_establised(int fd, struct inet_sk_desc *sk) goto err1; } - ret = nf_lock_connection(sk); - if (ret < 0) - goto err2; + if (!(opts.namespaces_flags & CLONE_NEWNET)) { + ret = nf_lock_connection(sk); + if (ret < 0) + goto err2; + } ret = tcp_repair_on(sk->rfd); if (ret < 0) @@ -79,7 +81,8 @@ static int tcp_repair_establised(int fd, struct inet_sk_desc *sk) return 0; err3: - nf_unlock_connection(sk); + if (!(opts.namespaces_flags & CLONE_NEWNET)) + nf_unlock_connection(sk); err2: close(sk->rfd); err1: