diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 15f1e32b430c72f381526b090cc4190a96db2ca3..654808bfad83d458781c2dc59d2ca80b34055af2 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1751,7 +1751,6 @@ enum netdev_priv_flags { * @xps_maps: XXX: need comments on this one * @miniq_egress: clsact qdisc specific data for * egress processing - * @nf_hooks_egress: netfilter hooks executed for egress packets * @qdisc_hash: qdisc hash table * @watchdog_timeo: Represents the timeout that is used by * the watchdog (see dev_watchdog()) @@ -2027,9 +2026,6 @@ struct net_device { #ifdef CONFIG_NET_CLS_ACT struct mini_Qdisc __rcu *miniq_egress; #endif -#ifdef CONFIG_NETFILTER_EGRESS - struct nf_hook_entries __rcu *nf_hooks_egress; -#endif #ifdef CONFIG_NET_SCHED DECLARE_HASHTABLE (qdisc_hash, 4); diff --git a/include/linux/netfilter_ingress.h b/include/linux/netfilter_ingress.h new file mode 100644 index 0000000000000000000000000000000000000000..a13774be2eb5b39aa73b94841b46aee7d993d1c3 --- /dev/null +++ b/include/linux/netfilter_ingress.h @@ -0,0 +1,58 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _NETFILTER_INGRESS_H_ +#define _NETFILTER_INGRESS_H_ + +#include +#include + +#ifdef CONFIG_NETFILTER_INGRESS +static inline bool nf_hook_ingress_active(const struct sk_buff *skb) +{ +#ifdef CONFIG_JUMP_LABEL + if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][NF_NETDEV_INGRESS])) + return false; +#endif + return rcu_access_pointer(skb->dev->nf_hooks_ingress); +} + +/* caller must hold rcu_read_lock */ +static inline int nf_hook_ingress(struct sk_buff *skb) +{ + struct nf_hook_entries *e = rcu_dereference(skb->dev->nf_hooks_ingress); + struct nf_hook_state state; + int ret; + + /* Must recheck the ingress hook head, in the event it became NULL + * after the check in nf_hook_ingress_active evaluated to true. + */ + if (unlikely(!e)) + return 0; + + nf_hook_state_init(&state, NF_NETDEV_INGRESS, + NFPROTO_NETDEV, skb->dev, NULL, NULL, + dev_net(skb->dev), NULL); + ret = nf_hook_slow(skb, &state, e, 0); + if (ret == 0) + return -1; + + return ret; +} + +static inline void nf_hook_ingress_init(struct net_device *dev) +{ + RCU_INIT_POINTER(dev->nf_hooks_ingress, NULL); +} +#else /* CONFIG_NETFILTER_INGRESS */ +static inline int nf_hook_ingress_active(struct sk_buff *skb) +{ + return 0; +} + +static inline int nf_hook_ingress(struct sk_buff *skb) +{ + return 0; +} + +static inline void nf_hook_ingress_init(struct net_device *dev) {} +#endif /* CONFIG_NETFILTER_INGRESS */ +#endif /* _NETFILTER_INGRESS_H_ */ diff --git a/include/linux/netfilter_netdev.h b/include/linux/netfilter_netdev.h deleted file mode 100644 index 92d3611a782e826765308ca75544f50cf5a284ab..0000000000000000000000000000000000000000 --- a/include/linux/netfilter_netdev.h +++ /dev/null @@ -1,102 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef _NETFILTER_NETDEV_H_ -#define _NETFILTER_NETDEV_H_ - -#include -#include - -#ifdef CONFIG_NETFILTER -static __always_inline bool nf_hook_netdev_active(enum nf_dev_hooks hooknum, - struct nf_hook_entries __rcu *hooks) -{ -#ifdef CONFIG_JUMP_LABEL - if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][hooknum])) - return false; -#endif - return rcu_access_pointer(hooks); -} - -/* caller must hold rcu_read_lock */ -static __always_inline int nf_hook_netdev(struct sk_buff *skb, - enum nf_dev_hooks hooknum, - struct nf_hook_entries __rcu *hooks) -{ - struct nf_hook_entries *e = rcu_dereference(hooks); - struct nf_hook_state state; - int ret; - - /* Must recheck the hook head, in the event it became NULL - * after the check in nf_hook_netdev_active evaluated to true. - */ - if (unlikely(!e)) - return 0; - - nf_hook_state_init(&state, hooknum, - NFPROTO_NETDEV, skb->dev, NULL, NULL, - dev_net(skb->dev), NULL); - ret = nf_hook_slow(skb, &state, e, 0); - if (ret == 0) - return -1; - - return ret; -} -#endif /* CONFIG_NETFILTER */ - -static inline void nf_hook_netdev_init(struct net_device *dev) -{ -#ifdef CONFIG_NETFILTER_INGRESS - RCU_INIT_POINTER(dev->nf_hooks_ingress, NULL); -#endif -#ifdef CONFIG_NETFILTER_EGRESS - RCU_INIT_POINTER(dev->nf_hooks_egress, NULL); -#endif -} - -#ifdef CONFIG_NETFILTER_INGRESS -static inline bool nf_hook_ingress_active(const struct sk_buff *skb) -{ - return nf_hook_netdev_active(NF_NETDEV_INGRESS, - skb->dev->nf_hooks_ingress); -} - -static inline int nf_hook_ingress(struct sk_buff *skb) -{ - return nf_hook_netdev(skb, NF_NETDEV_INGRESS, - skb->dev->nf_hooks_ingress); -} -#else /* CONFIG_NETFILTER_INGRESS */ -static inline int nf_hook_ingress_active(struct sk_buff *skb) -{ - return 0; -} - -static inline int nf_hook_ingress(struct sk_buff *skb) -{ - return 0; -} -#endif /* CONFIG_NETFILTER_INGRESS */ - -#ifdef CONFIG_NETFILTER_EGRESS -static inline bool nf_hook_egress_active(const struct sk_buff *skb) -{ - return nf_hook_netdev_active(NF_NETDEV_EGRESS, - skb->dev->nf_hooks_egress); -} - -static inline int nf_hook_egress(struct sk_buff *skb) -{ - return nf_hook_netdev(skb, NF_NETDEV_EGRESS, - skb->dev->nf_hooks_egress); -} -#else /* CONFIG_NETFILTER_EGRESS */ -static inline int nf_hook_egress_active(struct sk_buff *skb) -{ - return 0; -} - -static inline int nf_hook_egress(struct sk_buff *skb) -{ - return 0; -} -#endif /* CONFIG_NETFILTER_EGRESS */ -#endif /* _NETFILTER_INGRESS_H_ */ diff --git a/include/uapi/linux/netfilter.h b/include/uapi/linux/netfilter.h index d1616574c54f1abd2db45732fb59855812fa1afc..ca9e63d6e0e4dbdbf47466bf551c51eca6cafc3b 100644 --- a/include/uapi/linux/netfilter.h +++ b/include/uapi/linux/netfilter.h @@ -50,7 +50,6 @@ enum nf_inet_hooks { enum nf_dev_hooks { NF_NETDEV_INGRESS, - NF_NETDEV_EGRESS, NF_NETDEV_NUMHOOKS }; diff --git a/net/core/dev.c b/net/core/dev.c index aeb8ccbbe93b5ddcd9d6cc3ad8bf90c3865f49a0..021e18251465cf218bb41d6bdbe7298e6c3259ea 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -135,7 +135,7 @@ #include #include #include -#include +#include #include #include #include @@ -3773,7 +3773,6 @@ EXPORT_SYMBOL(dev_loopback_xmit); static struct sk_buff * sch_handle_egress(struct sk_buff *skb, int *ret, struct net_device *dev) { -#ifdef CONFIG_NET_CLS_ACT struct mini_Qdisc *miniq = rcu_dereference_bh(dev->miniq_egress); struct tcf_result cl_res; @@ -3807,24 +3806,11 @@ sch_handle_egress(struct sk_buff *skb, int *ret, struct net_device *dev) default: break; } -#endif /* CONFIG_NET_CLS_ACT */ + return skb; } #endif /* CONFIG_NET_EGRESS */ -static inline int nf_egress(struct sk_buff *skb) -{ - if (nf_hook_egress_active(skb)) { - int ret; - - rcu_read_lock(); - ret = nf_hook_egress(skb); - rcu_read_unlock(); - return ret; - } - return 0; -} - #ifdef CONFIG_XPS static int __get_xps_queue_idx(struct net_device *dev, struct sk_buff *skb, struct xps_dev_maps *dev_maps, unsigned int tci) @@ -4011,16 +3997,13 @@ static int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev) qdisc_pkt_len_init(skb); #ifdef CONFIG_NET_CLS_ACT skb->tc_at_ingress = 0; -#endif -#ifdef CONFIG_NET_EGRESS +# ifdef CONFIG_NET_EGRESS if (static_branch_unlikely(&egress_needed_key)) { - if (nf_egress(skb) < 0) - goto out; - skb = sch_handle_egress(skb, &rc, dev); if (!skb) goto out; } +# endif #endif /* If device/qdisc don't need skb->dst, release it right now while * its hot in this cpu cache. @@ -9867,7 +9850,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name, if (!dev->ethtool_ops) dev->ethtool_ops = &default_ethtool_ops; - nf_hook_netdev_init(dev); + nf_hook_ingress_init(dev); return dev; diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig index f4c68f60f24146551f85d2bf9e69e998368497c2..468fea1aebbaa0e50ad10312039c286fa3406953 100644 --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig @@ -10,14 +10,6 @@ config NETFILTER_INGRESS This allows you to classify packets from ingress using the Netfilter infrastructure. -config NETFILTER_EGRESS - bool "Netfilter egress support" - default y - select NET_EGRESS - help - This allows you to classify packets before transmission using the - Netfilter infrastructure. - config NETFILTER_NETLINK tristate diff --git a/net/netfilter/core.c b/net/netfilter/core.c index 85e9c959aba703a9523b15bab2e4440df32b7f13..78f046ec506fe205c24c5a87a8852d42953862dc 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -306,12 +306,6 @@ nf_hook_entry_head(struct net *net, int pf, unsigned int hooknum, if (dev && dev_net(dev) == net) return &dev->nf_hooks_ingress; } -#endif -#ifdef CONFIG_NETFILTER_EGRESS - if (hooknum == NF_NETDEV_EGRESS) { - if (dev && dev_net(dev) == net) - return &dev->nf_hooks_egress; - } #endif WARN_ON_ONCE(1); return NULL; @@ -324,13 +318,11 @@ static int __nf_register_net_hook(struct net *net, int pf, struct nf_hook_entries __rcu **pp; if (pf == NFPROTO_NETDEV) { - if ((!IS_ENABLED(CONFIG_NETFILTER_INGRESS) && - reg->hooknum == NF_NETDEV_INGRESS) || - (!IS_ENABLED(CONFIG_NETFILTER_EGRESS) && - reg->hooknum == NF_NETDEV_EGRESS)) +#ifndef CONFIG_NETFILTER_INGRESS + if (reg->hooknum == NF_NETDEV_INGRESS) return -EOPNOTSUPP; - if ((reg->hooknum != NF_NETDEV_INGRESS && - reg->hooknum != NF_NETDEV_EGRESS) || +#endif + if (reg->hooknum != NF_NETDEV_INGRESS || !reg->dev || dev_net(reg->dev) != net) return -EINVAL; } @@ -356,10 +348,6 @@ static int __nf_register_net_hook(struct net *net, int pf, if (pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) net_inc_ingress_queue(); #endif -#ifdef CONFIG_NETFILTER_EGRESS - if (pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_EGRESS) - net_inc_egress_queue(); -#endif #ifdef CONFIG_JUMP_LABEL static_key_slow_inc(&nf_hooks_needed[pf][reg->hooknum]); #endif @@ -418,10 +406,6 @@ static void __nf_unregister_net_hook(struct net *net, int pf, if (pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS) net_dec_ingress_queue(); #endif -#ifdef CONFIG_NETFILTER_EGRESS - if (pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_EGRESS) - net_dec_egress_queue(); -#endif #ifdef CONFIG_JUMP_LABEL static_key_slow_dec(&nf_hooks_needed[pf][reg->hooknum]); #endif diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c index 67ce6dbb549696ff40c37cd572360a228ad27b2e..c78d01bc02e9895a362387eb57c550e34329715d 100644 --- a/net/netfilter/nft_chain_filter.c +++ b/net/netfilter/nft_chain_filter.c @@ -277,11 +277,9 @@ static const struct nft_chain_type nft_chain_filter_netdev = { .name = "filter", .type = NFT_CHAIN_T_DEFAULT, .family = NFPROTO_NETDEV, - .hook_mask = (1 << NF_NETDEV_INGRESS) | - (1 << NF_NETDEV_EGRESS), + .hook_mask = (1 << NF_NETDEV_INGRESS), .hooks = { [NF_NETDEV_INGRESS] = nft_do_chain_netdev, - [NF_NETDEV_EGRESS] = nft_do_chain_netdev, }, };