History

netfilter: revert introduction of egress hook

This reverts the following commits: 8537f78647c0 ("netfilter: Introduce egress hook") 5418d3881e1f ("netfilter: Generalize ingress hook") b030f194aed2 ("netfilter: Rename ingress hook include file") >From the discussion in [0], the author's main motivation to add a hook in fast path is for an out of tree kernel module, which is a red flag to begin with. Other mentioned potential use cases like NAT{64,46} is on future extensions w/o concrete code in the tree yet. Revert as suggested [1] given the weak justification to add more hooks to critical fast-path. [0] https://lore.kernel.org/netdev/cover.1583927267.git.lukas@wunner.de/ [1] https://lore.kernel.org/netdev/20200318.011152.72770718915606186.davem@davemloft.net/

Daniel Borkmann committed 6 years ago

Commit 357b6cc1 parent ce7964b8 files · +68 −160Browse files

Showing the changes to include/linux (3 of 8 files). Show all

Unified · Split

3 files
  1. include/linux/netdevice.h +0 −4
  2. include/linux/netfilter_ingress.h +58 −0
  3. include/linux/netfilter_netdev.h +0 −102
include/linux/netdevice.h+0−4
@@ -1751,7 +1751,6 @@ enum netdev_priv_flags { · 1750 unmodified lines
17511751 * @xps_maps: XXX: need comments on this one
17521752 * @miniq_egress: clsact qdisc specific data for
17531753 * egress processing
1754− * @nf_hooks_egress: netfilter hooks executed for egress packets
17551754 * @qdisc_hash: qdisc hash table
17561755 * @watchdog_timeo: Represents the timeout that is used by
17571756 * the watchdog (see dev_watchdog())
@@ -2027,9 +2026,6 @@ struct net_device { · 269 unmodified lines
20272026 #ifdef CONFIG_NET_CLS_ACT
20282027 struct mini_Qdisc __rcu *miniq_egress;
20292028 #endif
2030−#ifdef CONFIG_NETFILTER_EGRESS
2031− struct nf_hook_entries __rcu *nf_hooks_egress;
2032−#endif
20332029
20342030 #ifdef CONFIG_NET_SCHED
20352031 DECLARE_HASHTABLE (qdisc_hash, 4);
include/linux/netfilter_ingress.h+58−0
@@ -0,0 +1,58 @@
1+/* SPDX-License-Identifier: GPL-2.0 */
2+#ifndef _NETFILTER_INGRESS_H_
3+#define _NETFILTER_INGRESS_H_
4+
5+#include <linux/netfilter.h>
6+#include <linux/netdevice.h>
7+
8+#ifdef CONFIG_NETFILTER_INGRESS
9+static inline bool nf_hook_ingress_active(const struct sk_buff *skb)
10+{
11+#ifdef CONFIG_JUMP_LABEL
12+ if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][NF_NETDEV_INGRESS]))
13+ return false;
14+#endif
15+ return rcu_access_pointer(skb->dev->nf_hooks_ingress);
16+}
17+
18+/* caller must hold rcu_read_lock */
19+static inline int nf_hook_ingress(struct sk_buff *skb)
20+{
21+ struct nf_hook_entries *e = rcu_dereference(skb->dev->nf_hooks_ingress);
22+ struct nf_hook_state state;
23+ int ret;
24+
25+ /* Must recheck the ingress hook head, in the event it became NULL
26+ * after the check in nf_hook_ingress_active evaluated to true.
27+ */
28+ if (unlikely(!e))
29+ return 0;
30+
31+ nf_hook_state_init(&state, NF_NETDEV_INGRESS,
32+ NFPROTO_NETDEV, skb->dev, NULL, NULL,
33+ dev_net(skb->dev), NULL);
34+ ret = nf_hook_slow(skb, &state, e, 0);
35+ if (ret == 0)
36+ return -1;
37+
38+ return ret;
39+}
40+
41+static inline void nf_hook_ingress_init(struct net_device *dev)
42+{
43+ RCU_INIT_POINTER(dev->nf_hooks_ingress, NULL);
44+}
45+#else /* CONFIG_NETFILTER_INGRESS */
46+static inline int nf_hook_ingress_active(struct sk_buff *skb)
47+{
48+ return 0;
49+}
50+
51+static inline int nf_hook_ingress(struct sk_buff *skb)
52+{
53+ return 0;
54+}
55+
56+static inline void nf_hook_ingress_init(struct net_device *dev) {}
57+#endif /* CONFIG_NETFILTER_INGRESS */
58+#endif /* _NETFILTER_INGRESS_H_ */
include/linux/netfilter_netdev.h+0−102
@@ -1,102 +0,0 @@
1−/* SPDX-License-Identifier: GPL-2.0 */
2−#ifndef _NETFILTER_NETDEV_H_
3−#define _NETFILTER_NETDEV_H_
4−
5−#include <linux/netfilter.h>
6−#include <linux/netdevice.h>
7−
8−#ifdef CONFIG_NETFILTER
9−static __always_inline bool nf_hook_netdev_active(enum nf_dev_hooks hooknum,
10− struct nf_hook_entries __rcu *hooks)
11−{
12−#ifdef CONFIG_JUMP_LABEL
13− if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][hooknum]))
14− return false;
15−#endif
16− return rcu_access_pointer(hooks);
17−}
18−
19−/* caller must hold rcu_read_lock */
20−static __always_inline int nf_hook_netdev(struct sk_buff *skb,
21− enum nf_dev_hooks hooknum,
22− struct nf_hook_entries __rcu *hooks)
23−{
24− struct nf_hook_entries *e = rcu_dereference(hooks);
25− struct nf_hook_state state;
26− int ret;
27−
28− /* Must recheck the hook head, in the event it became NULL
29− * after the check in nf_hook_netdev_active evaluated to true.
30− */
31− if (unlikely(!e))
32− return 0;
33−
34− nf_hook_state_init(&state, hooknum,
35− NFPROTO_NETDEV, skb->dev, NULL, NULL,
36− dev_net(skb->dev), NULL);
37− ret = nf_hook_slow(skb, &state, e, 0);
38− if (ret == 0)
39− return -1;
40−
41− return ret;
42−}
43−#endif /* CONFIG_NETFILTER */
44−
45−static inline void nf_hook_netdev_init(struct net_device *dev)
46−{
47−#ifdef CONFIG_NETFILTER_INGRESS
48− RCU_INIT_POINTER(dev->nf_hooks_ingress, NULL);
49−#endif
50−#ifdef CONFIG_NETFILTER_EGRESS
51− RCU_INIT_POINTER(dev->nf_hooks_egress, NULL);
52−#endif
53−}
54−
55−#ifdef CONFIG_NETFILTER_INGRESS
56−static inline bool nf_hook_ingress_active(const struct sk_buff *skb)
57−{
58− return nf_hook_netdev_active(NF_NETDEV_INGRESS,
59− skb->dev->nf_hooks_ingress);
60−}
61−
62−static inline int nf_hook_ingress(struct sk_buff *skb)
63−{
64− return nf_hook_netdev(skb, NF_NETDEV_INGRESS,
65− skb->dev->nf_hooks_ingress);
66−}
67−#else /* CONFIG_NETFILTER_INGRESS */
68−static inline int nf_hook_ingress_active(struct sk_buff *skb)
69−{
70− return 0;
71−}
72−
73−static inline int nf_hook_ingress(struct sk_buff *skb)
74−{
75− return 0;
76−}
77−#endif /* CONFIG_NETFILTER_INGRESS */
78−
79−#ifdef CONFIG_NETFILTER_EGRESS
80−static inline bool nf_hook_egress_active(const struct sk_buff *skb)
81−{
82− return nf_hook_netdev_active(NF_NETDEV_EGRESS,
83− skb->dev->nf_hooks_egress);
84−}
85−
86−static inline int nf_hook_egress(struct sk_buff *skb)
87−{
88− return nf_hook_netdev(skb, NF_NETDEV_EGRESS,
89− skb->dev->nf_hooks_egress);
90−}
91−#else /* CONFIG_NETFILTER_EGRESS */
92−static inline int nf_hook_egress_active(struct sk_buff *skb)
93−{
94− return 0;
95−}
96−
97−static inline int nf_hook_egress(struct sk_buff *skb)
98−{
99− return 0;
100−}
101−#endif /* CONFIG_NETFILTER_EGRESS */
102−#endif /* _NETFILTER_INGRESS_H_ */