History

netfilter: revert introduction of egress hook

This reverts the following commits: 8537f78647c0 ("netfilter: Introduce egress hook") 5418d3881e1f ("netfilter: Generalize ingress hook") b030f194aed2 ("netfilter: Rename ingress hook include file") >From the discussion in [0], the author's main motivation to add a hook in fast path is for an out of tree kernel module, which is a red flag to begin with. Other mentioned potential use cases like NAT{64,46} is on future extensions w/o concrete code in the tree yet. Revert as suggested [1] given the weak justification to add more hooks to critical fast-path. [0] https://lore.kernel.org/netdev/cover.1583927267.git.lukas@wunner.de/ [1] https://lore.kernel.org/netdev/20200318.011152.72770718915606186.davem@davemloft.net/

Daniel Borkmann committed 6 years ago

Commit 357b6cc1 parent ce7964b8 files · +68 −160Browse files

Showing the changes to include/linux (3 of 8 files). Show all

Unified · Split

3 files
  1. include/linux/netdevice.h +0 −4
  2. include/linux/netfilter_ingress.h +58 −0
  3. include/linux/netfilter_netdev.h +0 −102
include/linux/netdevice.h+0−4
@@ -1751,7 +1751,6 @@ enum netdev_priv_flags { · 1750 unmodified lines
1751 * @xps_maps: XXX: need comments on this one1751 * @xps_maps: XXX: need comments on this one
1752 * @miniq_egress: clsact qdisc specific data for1752 * @miniq_egress: clsact qdisc specific data for
1753 * egress processing1753 * egress processing
1754 * @nf_hooks_egress: netfilter hooks executed for egress packets
1755 * @qdisc_hash: qdisc hash table1754 * @qdisc_hash: qdisc hash table
1756 * @watchdog_timeo: Represents the timeout that is used by1755 * @watchdog_timeo: Represents the timeout that is used by
1757 * the watchdog (see dev_watchdog())1756 * the watchdog (see dev_watchdog())
@@ -2027,9 +2026,6 @@ struct net_device { · 269 unmodified lines
2027#ifdef CONFIG_NET_CLS_ACT2026#ifdef CONFIG_NET_CLS_ACT
2028 struct mini_Qdisc __rcu *miniq_egress;2027 struct mini_Qdisc __rcu *miniq_egress;
2029#endif2028#endif
2030#ifdef CONFIG_NETFILTER_EGRESS
2031 struct nf_hook_entries __rcu *nf_hooks_egress;
2032#endif
2033 2029
2034#ifdef CONFIG_NET_SCHED2030#ifdef CONFIG_NET_SCHED
2035 DECLARE_HASHTABLE (qdisc_hash, 4);2031 DECLARE_HASHTABLE (qdisc_hash, 4);
include/linux/netfilter_ingress.h+58−0
@@ -0,0 +1,58 @@
1/* SPDX-License-Identifier: GPL-2.0 */
2#ifndef _NETFILTER_INGRESS_H_
3#define _NETFILTER_INGRESS_H_
4
5#include <linux/netfilter.h>
6#include <linux/netdevice.h>
7
8#ifdef CONFIG_NETFILTER_INGRESS
9static inline bool nf_hook_ingress_active(const struct sk_buff *skb)
10{
11#ifdef CONFIG_JUMP_LABEL
12 if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][NF_NETDEV_INGRESS]))
13 return false;
14#endif
15 return rcu_access_pointer(skb->dev->nf_hooks_ingress);
16}
17
18/* caller must hold rcu_read_lock */
19static inline int nf_hook_ingress(struct sk_buff *skb)
20{
21 struct nf_hook_entries *e = rcu_dereference(skb->dev->nf_hooks_ingress);
22 struct nf_hook_state state;
23 int ret;
24
25 /* Must recheck the ingress hook head, in the event it became NULL
26 * after the check in nf_hook_ingress_active evaluated to true.
27 */
28 if (unlikely(!e))
29 return 0;
30
31 nf_hook_state_init(&state, NF_NETDEV_INGRESS,
32 NFPROTO_NETDEV, skb->dev, NULL, NULL,
33 dev_net(skb->dev), NULL);
34 ret = nf_hook_slow(skb, &state, e, 0);
35 if (ret == 0)
36 return -1;
37
38 return ret;
39}
40
41static inline void nf_hook_ingress_init(struct net_device *dev)
42{
43 RCU_INIT_POINTER(dev->nf_hooks_ingress, NULL);
44}
45#else /* CONFIG_NETFILTER_INGRESS */
46static inline int nf_hook_ingress_active(struct sk_buff *skb)
47{
48 return 0;
49}
50
51static inline int nf_hook_ingress(struct sk_buff *skb)
52{
53 return 0;
54}
55
56static inline void nf_hook_ingress_init(struct net_device *dev) {}
57#endif /* CONFIG_NETFILTER_INGRESS */
58#endif /* _NETFILTER_INGRESS_H_ */
include/linux/netfilter_netdev.h+0−102
@@ -1,102 +0,0 @@
1/* SPDX-License-Identifier: GPL-2.0 */
2#ifndef _NETFILTER_NETDEV_H_
3#define _NETFILTER_NETDEV_H_
4
5#include <linux/netfilter.h>
6#include <linux/netdevice.h>
7
8#ifdef CONFIG_NETFILTER
9static __always_inline bool nf_hook_netdev_active(enum nf_dev_hooks hooknum,
10 struct nf_hook_entries __rcu *hooks)
11{
12#ifdef CONFIG_JUMP_LABEL
13 if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][hooknum]))
14 return false;
15#endif
16 return rcu_access_pointer(hooks);
17}
18
19/* caller must hold rcu_read_lock */
20static __always_inline int nf_hook_netdev(struct sk_buff *skb,
21 enum nf_dev_hooks hooknum,
22 struct nf_hook_entries __rcu *hooks)
23{
24 struct nf_hook_entries *e = rcu_dereference(hooks);
25 struct nf_hook_state state;
26 int ret;
27
28 /* Must recheck the hook head, in the event it became NULL
29 * after the check in nf_hook_netdev_active evaluated to true.
30 */
31 if (unlikely(!e))
32 return 0;
33
34 nf_hook_state_init(&state, hooknum,
35 NFPROTO_NETDEV, skb->dev, NULL, NULL,
36 dev_net(skb->dev), NULL);
37 ret = nf_hook_slow(skb, &state, e, 0);
38 if (ret == 0)
39 return -1;
40
41 return ret;
42}
43#endif /* CONFIG_NETFILTER */
44
45static inline void nf_hook_netdev_init(struct net_device *dev)
46{
47#ifdef CONFIG_NETFILTER_INGRESS
48 RCU_INIT_POINTER(dev->nf_hooks_ingress, NULL);
49#endif
50#ifdef CONFIG_NETFILTER_EGRESS
51 RCU_INIT_POINTER(dev->nf_hooks_egress, NULL);
52#endif
53}
54
55#ifdef CONFIG_NETFILTER_INGRESS
56static inline bool nf_hook_ingress_active(const struct sk_buff *skb)
57{
58 return nf_hook_netdev_active(NF_NETDEV_INGRESS,
59 skb->dev->nf_hooks_ingress);
60}
61
62static inline int nf_hook_ingress(struct sk_buff *skb)
63{
64 return nf_hook_netdev(skb, NF_NETDEV_INGRESS,
65 skb->dev->nf_hooks_ingress);
66}
67#else /* CONFIG_NETFILTER_INGRESS */
68static inline int nf_hook_ingress_active(struct sk_buff *skb)
69{
70 return 0;
71}
72
73static inline int nf_hook_ingress(struct sk_buff *skb)
74{
75 return 0;
76}
77#endif /* CONFIG_NETFILTER_INGRESS */
78
79#ifdef CONFIG_NETFILTER_EGRESS
80static inline bool nf_hook_egress_active(const struct sk_buff *skb)
81{
82 return nf_hook_netdev_active(NF_NETDEV_EGRESS,
83 skb->dev->nf_hooks_egress);
84}
85
86static inline int nf_hook_egress(struct sk_buff *skb)
87{
88 return nf_hook_netdev(skb, NF_NETDEV_EGRESS,
89 skb->dev->nf_hooks_egress);
90}
91#else /* CONFIG_NETFILTER_EGRESS */
92static inline int nf_hook_egress_active(struct sk_buff *skb)
93{
94 return 0;
95}
96
97static inline int nf_hook_egress(struct sk_buff *skb)
98{
99 return 0;
100}
101#endif /* CONFIG_NETFILTER_EGRESS */
102#endif /* _NETFILTER_INGRESS_H_ */