[NETFILTER]: ip_tables: per-netns FILTER, MANGLE, RAW

Now, iptables show and configure different set of rules in different
netnss'. Filtering decisions are still made by consulting only
init_net's set.

Changes are identical except naming so no splitting.

P.S.: one need to remove init_net checks in nf_sockopt.c and inet_create()
      to see the effect.

Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 5 insertions, 0 deletions

diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 15a0b052df22..aeb0c3b8df11 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -27,5 +27,10 @@ struct netns_ipv4 {
         struct sock             *fibnl;
 
         struct netns_frags      frags;
+#ifdef CONFIG_NETFILTER
+        struct xt_table         *iptable_filter;
+        struct xt_table         *iptable_mangle;
+        struct xt_table         *iptable_raw;
+#endif
 };
 #endif