diff options
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/netdevice.h | 4 | ||||
| -rw-r--r-- | include/linux/netfilter_ingress.h | 58 | ||||
| -rw-r--r-- | include/linux/netfilter_netdev.h | 102 | ||||
| -rw-r--r-- | include/uapi/linux/netfilter.h | 1 |
4 files changed, 58 insertions, 107 deletions
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 15f1e32b430c..654808bfad83 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -1751,7 +1751,6 @@ enum netdev_priv_flags { * @xps_maps: XXX: need comments on this one * @miniq_egress: clsact qdisc specific data for * egress processing - * @nf_hooks_egress: netfilter hooks executed for egress packets * @qdisc_hash: qdisc hash table * @watchdog_timeo: Represents the timeout that is used by * the watchdog (see dev_watchdog()) @@ -2027,9 +2026,6 @@ struct net_device { #ifdef CONFIG_NET_CLS_ACT struct mini_Qdisc __rcu *miniq_egress; #endif -#ifdef CONFIG_NETFILTER_EGRESS - struct nf_hook_entries __rcu *nf_hooks_egress; -#endif #ifdef CONFIG_NET_SCHED DECLARE_HASHTABLE (qdisc_hash, 4); diff --git a/include/linux/netfilter_ingress.h b/include/linux/netfilter_ingress.h new file mode 100644 index 000000000000..a13774be2eb5 --- /dev/null +++ b/include/linux/netfilter_ingress.h @@ -0,0 +1,58 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _NETFILTER_INGRESS_H_ +#define _NETFILTER_INGRESS_H_ + +#include <linux/netfilter.h> +#include <linux/netdevice.h> + +#ifdef CONFIG_NETFILTER_INGRESS +static inline bool nf_hook_ingress_active(const struct sk_buff *skb) +{ +#ifdef CONFIG_JUMP_LABEL + if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][NF_NETDEV_INGRESS])) + return false; +#endif + return rcu_access_pointer(skb->dev->nf_hooks_ingress); +} + +/* caller must hold rcu_read_lock */ +static inline int nf_hook_ingress(struct sk_buff *skb) +{ + struct nf_hook_entries *e = rcu_dereference(skb->dev->nf_hooks_ingress); + struct nf_hook_state state; + int ret; + + /* Must recheck the ingress hook head, in the event it became NULL + * after the check in nf_hook_ingress_active evaluated to true. + */ + if (unlikely(!e)) + return 0; + + nf_hook_state_init(&state, NF_NETDEV_INGRESS, + NFPROTO_NETDEV, skb->dev, NULL, NULL, + dev_net(skb->dev), NULL); + ret = nf_hook_slow(skb, &state, e, 0); + if (ret == 0) + return -1; + + return ret; +} + +static inline void nf_hook_ingress_init(struct net_device *dev) +{ + RCU_INIT_POINTER(dev->nf_hooks_ingress, NULL); +} +#else /* CONFIG_NETFILTER_INGRESS */ +static inline int nf_hook_ingress_active(struct sk_buff *skb) +{ + return 0; +} + +static inline int nf_hook_ingress(struct sk_buff *skb) +{ + return 0; +} + +static inline void nf_hook_ingress_init(struct net_device *dev) {} +#endif /* CONFIG_NETFILTER_INGRESS */ +#endif /* _NETFILTER_INGRESS_H_ */ diff --git a/include/linux/netfilter_netdev.h b/include/linux/netfilter_netdev.h deleted file mode 100644 index 92d3611a782e..000000000000 --- a/include/linux/netfilter_netdev.h +++ /dev/null @@ -1,102 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef _NETFILTER_NETDEV_H_ -#define _NETFILTER_NETDEV_H_ - -#include <linux/netfilter.h> -#include <linux/netdevice.h> - -#ifdef CONFIG_NETFILTER -static __always_inline bool nf_hook_netdev_active(enum nf_dev_hooks hooknum, - struct nf_hook_entries __rcu *hooks) -{ -#ifdef CONFIG_JUMP_LABEL - if (!static_key_false(&nf_hooks_needed[NFPROTO_NETDEV][hooknum])) - return false; -#endif - return rcu_access_pointer(hooks); -} - -/* caller must hold rcu_read_lock */ -static __always_inline int nf_hook_netdev(struct sk_buff *skb, - enum nf_dev_hooks hooknum, - struct nf_hook_entries __rcu *hooks) -{ - struct nf_hook_entries *e = rcu_dereference(hooks); - struct nf_hook_state state; - int ret; - - /* Must recheck the hook head, in the event it became NULL - * after the check in nf_hook_netdev_active evaluated to true. - */ - if (unlikely(!e)) - return 0; - - nf_hook_state_init(&state, hooknum, - NFPROTO_NETDEV, skb->dev, NULL, NULL, - dev_net(skb->dev), NULL); - ret = nf_hook_slow(skb, &state, e, 0); - if (ret == 0) - return -1; - - return ret; -} -#endif /* CONFIG_NETFILTER */ - -static inline void nf_hook_netdev_init(struct net_device *dev) -{ -#ifdef CONFIG_NETFILTER_INGRESS - RCU_INIT_POINTER(dev->nf_hooks_ingress, NULL); -#endif -#ifdef CONFIG_NETFILTER_EGRESS - RCU_INIT_POINTER(dev->nf_hooks_egress, NULL); -#endif -} - -#ifdef CONFIG_NETFILTER_INGRESS -static inline bool nf_hook_ingress_active(const struct sk_buff *skb) -{ - return nf_hook_netdev_active(NF_NETDEV_INGRESS, - skb->dev->nf_hooks_ingress); -} - -static inline int nf_hook_ingress(struct sk_buff *skb) -{ - return nf_hook_netdev(skb, NF_NETDEV_INGRESS, - skb->dev->nf_hooks_ingress); -} -#else /* CONFIG_NETFILTER_INGRESS */ -static inline int nf_hook_ingress_active(struct sk_buff *skb) -{ - return 0; -} - -static inline int nf_hook_ingress(struct sk_buff *skb) -{ - return 0; -} -#endif /* CONFIG_NETFILTER_INGRESS */ - -#ifdef CONFIG_NETFILTER_EGRESS -static inline bool nf_hook_egress_active(const struct sk_buff *skb) -{ - return nf_hook_netdev_active(NF_NETDEV_EGRESS, - skb->dev->nf_hooks_egress); -} - -static inline int nf_hook_egress(struct sk_buff *skb) -{ - return nf_hook_netdev(skb, NF_NETDEV_EGRESS, - skb->dev->nf_hooks_egress); -} -#else /* CONFIG_NETFILTER_EGRESS */ -static inline int nf_hook_egress_active(struct sk_buff *skb) -{ - return 0; -} - -static inline int nf_hook_egress(struct sk_buff *skb) -{ - return 0; -} -#endif /* CONFIG_NETFILTER_EGRESS */ -#endif /* _NETFILTER_INGRESS_H_ */ diff --git a/include/uapi/linux/netfilter.h b/include/uapi/linux/netfilter.h index d1616574c54f..ca9e63d6e0e4 100644 --- a/include/uapi/linux/netfilter.h +++ b/include/uapi/linux/netfilter.h @@ -50,7 +50,6 @@ enum nf_inet_hooks { enum nf_dev_hooks { NF_NETDEV_INGRESS, - NF_NETDEV_EGRESS, NF_NETDEV_NUMHOOKS }; |