Commit 357b6cc5 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by David S. Miller
Browse files

netfilter: revert introduction of egress hook 

This reverts the following commits:

  8537f786 ("netfilter: Introduce egress hook")
  5418d388 ("netfilter: Generalize ingress hook")
  b030f194 ("netfilter: Rename ingress hook include file")

>From the discussion in [0], the author's main motivation to add a hook
in fast path is for an out of tree kernel module, which is a red flag
to begin with. Other mentioned potential use cases like NAT{64,46}
is on future extensions w/o concrete code in the tree yet. Revert as
suggested [1] given the weak justification to add more hooks to critical
fast-path.

  [0] https://lore.kernel.org/netdev/cover.1583927267.git.lukas@wunner.de/
  [1] https://lore.kernel.org/netdev/20200318.011152.72770718915606186.davem@davemloft.net/



Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Cc: David Miller <davem@davemloft.net>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Nacked-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ce7964bd

include/linux/netdevice.h

+0 −4
Original line number Diff line number Diff line
@@ -1751,7 +1751,6 @@ enum netdev_priv_flags { 
 *	@xps_maps:	XXX: need comments on this one

 *	@miniq_egress:		clsact qdisc specific data for

 *				egress processing

 *	@nf_hooks_egress:	netfilter hooks executed for egress packets

 *	@qdisc_hash:		qdisc hash table

 *	@watchdog_timeo:	Represents the timeout that is used by

 *				the watchdog (see dev_watchdog())
@@ -2027,9 +2026,6 @@ struct net_device { 
#ifdef CONFIG_NET_CLS_ACT

	struct mini_Qdisc __rcu	*miniq_egress;

#endif

#ifdef CONFIG_NETFILTER_EGRESS

	struct nf_hook_entries __rcu *nf_hooks_egress;

#endif



#ifdef CONFIG_NET_SCHED

	DECLARE_HASHTABLE	(qdisc_hash, 4);

include/linux/netfilter_netdev.h→include/linux/netfilter_ingress.h

+58 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

#ifndef _NETFILTER_NETDEV_H_

#define _NETFILTER_NETDEV_H_

#ifndef _NETFILTER_INGRESS_H_

#define _NETFILTER_INGRESS_H_



#include <linux/netfilter.h>

#include <linux/netdevice.h>



#ifdef CONFIG_NETFILTER

static __always_inline bool nf_hook_netdev_active(enum nf_dev_hooks hooknum,

					  struct nf_hook_entries __rcu *hooks)

#ifdef CONFIG_NETFILTER_INGRESS

static inline bool nf_hook_ingress_active(const struct sk_buff *skb)

{

#ifdef CONFIG_JUMP_LABEL

	if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][hooknum]))

	if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][NF_NETDEV_INGRESS]))

		return false;

#endif

	return rcu_access_pointer(hooks);

	return rcu_access_pointer(skb->dev->nf_hooks_ingress);

}



/* caller must hold rcu_read_lock */

static __always_inline int nf_hook_netdev(struct sk_buff *skb,

					  enum nf_dev_hooks hooknum,

					  struct nf_hook_entries __rcu *hooks)

static inline int nf_hook_ingress(struct sk_buff *skb)

{

	struct nf_hook_entries *e = rcu_dereference(hooks);

	struct nf_hook_entries *e = rcu_dereference(skb->dev->nf_hooks_ingress);

	struct nf_hook_state state;

	int ret;



	/* Must recheck the hook head, in the event it became NULL

	 * after the check in nf_hook_netdev_active evaluated to true.

	/* Must recheck the ingress hook head, in the event it became NULL

	 * after the check in nf_hook_ingress_active evaluated to true.

	 */

	if (unlikely(!e))

		return 0;



	nf_hook_state_init(&state, hooknum,

	nf_hook_state_init(&state, NF_NETDEV_INGRESS,

			   NFPROTO_NETDEV, skb->dev, NULL, NULL,

			   dev_net(skb->dev), NULL);

	ret = nf_hook_slow(skb, &state, e, 0);
@@ -40,29 +37,10 @@ static __always_inline int nf_hook_netdev(struct sk_buff *skb, 


	return ret;

}

#endif /* CONFIG_NETFILTER */



static inline void nf_hook_netdev_init(struct net_device *dev)

static inline void nf_hook_ingress_init(struct net_device *dev)

{

#ifdef CONFIG_NETFILTER_INGRESS

	RCU_INIT_POINTER(dev->nf_hooks_ingress, NULL);

#endif

#ifdef CONFIG_NETFILTER_EGRESS

	RCU_INIT_POINTER(dev->nf_hooks_egress, NULL);

#endif

}



#ifdef CONFIG_NETFILTER_INGRESS

static inline bool nf_hook_ingress_active(const struct sk_buff *skb)

{

	return nf_hook_netdev_active(NF_NETDEV_INGRESS,

				     skb->dev->nf_hooks_ingress);

}



static inline int nf_hook_ingress(struct sk_buff *skb)

{

	return nf_hook_netdev(skb, NF_NETDEV_INGRESS,

			      skb->dev->nf_hooks_ingress);

}

#else /* CONFIG_NETFILTER_INGRESS */

static inline int nf_hook_ingress_active(struct sk_buff *skb)
@@ -74,29 +52,7 @@ static inline int nf_hook_ingress(struct sk_buff *skb) 
{

	return 0;

}

#endif /* CONFIG_NETFILTER_INGRESS */



#ifdef CONFIG_NETFILTER_EGRESS

static inline bool nf_hook_egress_active(const struct sk_buff *skb)

{

	return nf_hook_netdev_active(NF_NETDEV_EGRESS,

				     skb->dev->nf_hooks_egress);

}



static inline int nf_hook_egress(struct sk_buff *skb)

{

	return nf_hook_netdev(skb, NF_NETDEV_EGRESS,

			      skb->dev->nf_hooks_egress);

}

#else /* CONFIG_NETFILTER_EGRESS */

static inline int nf_hook_egress_active(struct sk_buff *skb)

{

	return 0;

}



static inline int nf_hook_egress(struct sk_buff *skb)

{

	return 0;

}

#endif /* CONFIG_NETFILTER_EGRESS */

static inline void nf_hook_ingress_init(struct net_device *dev) {}

#endif /* CONFIG_NETFILTER_INGRESS */

#endif /* _NETFILTER_INGRESS_H_ */

include/uapi/linux/netfilter.h

+0 −1
Original line number Diff line number Diff line
@@ -50,7 +50,6 @@ enum nf_inet_hooks { 


enum nf_dev_hooks {

	NF_NETDEV_INGRESS,

	NF_NETDEV_EGRESS,

	NF_NETDEV_NUMHOOKS

};

net/core/dev.c

+5 −22
Original line number Diff line number Diff line
@@ -135,7 +135,7 @@ 
#include <linux/if_macvlan.h>

#include <linux/errqueue.h>

#include <linux/hrtimer.h>

#include <linux/netfilter_netdev.h>

#include <linux/netfilter_ingress.h>

#include <linux/crash_dump.h>

#include <linux/sctp.h>

#include <net/udp_tunnel.h>
@@ -3773,7 +3773,6 @@ EXPORT_SYMBOL(dev_loopback_xmit); 
static struct sk_buff *

sch_handle_egress(struct sk_buff *skb, int *ret, struct net_device *dev)

{

#ifdef CONFIG_NET_CLS_ACT

	struct mini_Qdisc *miniq = rcu_dereference_bh(dev->miniq_egress);

	struct tcf_result cl_res;
@@ -3807,24 +3806,11 @@ sch_handle_egress(struct sk_buff *skb, int *ret, struct net_device *dev) 
	default:

		break;

	}

#endif /* CONFIG_NET_CLS_ACT */



	return skb;

}

#endif /* CONFIG_NET_EGRESS */



static inline int nf_egress(struct sk_buff *skb)

{

	if (nf_hook_egress_active(skb)) {

		int ret;



		rcu_read_lock();

		ret = nf_hook_egress(skb);

		rcu_read_unlock();

		return ret;

	}

	return 0;

}



#ifdef CONFIG_XPS

static int __get_xps_queue_idx(struct net_device *dev, struct sk_buff *skb,

			       struct xps_dev_maps *dev_maps, unsigned int tci)
@@ -4011,16 +3997,13 @@ static int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev) 
	qdisc_pkt_len_init(skb);

#ifdef CONFIG_NET_CLS_ACT

	skb->tc_at_ingress = 0;

#endif

# ifdef CONFIG_NET_EGRESS

	if (static_branch_unlikely(&egress_needed_key)) {

		if (nf_egress(skb) < 0)

			goto out;



		skb = sch_handle_egress(skb, &rc, dev);

		if (!skb)

			goto out;

	}

# endif

#endif

	/* If device/qdisc don't need skb->dst, release it right now while

	 * its hot in this cpu cache.
@@ -9867,7 +9850,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name, 
	if (!dev->ethtool_ops)

		dev->ethtool_ops = &default_ethtool_ops;



	nf_hook_netdev_init(dev);

	nf_hook_ingress_init(dev);



	return dev;

net/netfilter/Kconfig

+0 −8
Original line number Diff line number Diff line
@@ -10,14 +10,6 @@ config NETFILTER_INGRESS 
	  This allows you to classify packets from ingress using the Netfilter

	  infrastructure.



config NETFILTER_EGRESS

	bool "Netfilter egress support"

	default y

	select NET_EGRESS

	help

	  This allows you to classify packets before transmission using the

	  Netfilter infrastructure.



config NETFILTER_NETLINK

	tristate

CRA Git | Maintained and supported by SUSTech CRA and CCSE