[PATCH nf] netfilter: remove old pre-netns era hook api

[PATCH nf] netfilter: remove old pre-netns era hook api

[Florian Westphal]

no more users in the tree, remove this.

The old api is racy wrt. module removal, all users have been converted
to the netns-aware api.

The old api pretended we still have global hooks but that has not been
true for a long time.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 include/linux/netfilter.h |   9 ---
 net/netfilter/core.c      | 143 ----------------------------------------------
 2 files changed, 152 deletions(-)

diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index a4b97be..22f0810 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -61,8 +61,6 @@ typedef unsigned int nf_hookfn(void *priv,
 			       struct sk_buff *skb,
 			       const struct nf_hook_state *state);
 struct nf_hook_ops {
-	struct list_head	list;
-
 	/* User fills in from here down. */
 	nf_hookfn		*hook;
 	struct net_device	*dev;
@@ -160,13 +158,6 @@ int nf_register_net_hooks(struct net *net, const struct nf_hook_ops *reg,
 void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
 			     unsigned int n);
 
-int nf_register_hook(struct nf_hook_ops *reg);
-void nf_unregister_hook(struct nf_hook_ops *reg);
-int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
-void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
-int _nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
-void _nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
-
 /* Functions to register get/setsockopt ranges (non-inclusive).  You
    need to check permissions yourself! */
 int nf_register_sockopt(struct nf_sockopt_ops *reg);
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 552d606..368610d 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -227,114 +227,6 @@ void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
 }
 EXPORT_SYMBOL(nf_unregister_net_hooks);
 
-static LIST_HEAD(nf_hook_list);
-
-static int _nf_register_hook(struct nf_hook_ops *reg)
-{
-	struct net *net, *last;
-	int ret;
-
-	for_each_net(net) {
-		ret = nf_register_net_hook(net, reg);
-		if (ret && ret != -ENOENT)
-			goto rollback;
-	}
-	list_add_tail(&reg->list, &nf_hook_list);
-
-	return 0;
-rollback:
-	last = net;
-	for_each_net(net) {
-		if (net == last)
-			break;
-		nf_unregister_net_hook(net, reg);
-	}
-	return ret;
-}
-
-int nf_register_hook(struct nf_hook_ops *reg)
-{
-	int ret;
-
-	rtnl_lock();
-	ret = _nf_register_hook(reg);
-	rtnl_unlock();
-
-	return ret;
-}
-EXPORT_SYMBOL(nf_register_hook);
-
-static void _nf_unregister_hook(struct nf_hook_ops *reg)
-{
-	struct net *net;
-
-	list_del(&reg->list);
-	for_each_net(net)
-		nf_unregister_net_hook(net, reg);
-}
-
-void nf_unregister_hook(struct nf_hook_ops *reg)
-{
-	rtnl_lock();
-	_nf_unregister_hook(reg);
-	rtnl_unlock();
-}
-EXPORT_SYMBOL(nf_unregister_hook);
-
-int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
-{
-	unsigned int i;
-	int err = 0;
-
-	for (i = 0; i < n; i++) {
-		err = nf_register_hook(&reg[i]);
-		if (err)
-			goto err;
-	}
-	return err;
-
-err:
-	if (i > 0)
-		nf_unregister_hooks(reg, i);
-	return err;
-}
-EXPORT_SYMBOL(nf_register_hooks);
-
-/* Caller MUST take rtnl_lock() */
-int _nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
-{
-	unsigned int i;
-	int err = 0;
-
-	for (i = 0; i < n; i++) {
-		err = _nf_register_hook(&reg[i]);
-		if (err)
-			goto err;
-	}
-	return err;
-
-err:
-	if (i > 0)
-		_nf_unregister_hooks(reg, i);
-	return err;
-}
-EXPORT_SYMBOL(_nf_register_hooks);
-
-void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
-{
-	while (n-- > 0)
-		nf_unregister_hook(&reg[n]);
-}
-EXPORT_SYMBOL(nf_unregister_hooks);
-
-/* Caller MUST take rtnl_lock */
-void _nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
-{
-	while (n-- > 0)
-		_nf_unregister_hook(&reg[n]);
-}
-EXPORT_SYMBOL(_nf_unregister_hooks);
-
 /* Returns 1 if okfn() needs to be executed by the caller,
  * -EPERM for NF_DROP, 0 otherwise.  Caller must hold rcu_read_lock. */
 int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
@@ -450,37 +342,6 @@ void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
 EXPORT_SYMBOL(nf_nat_decode_session_hook);
 #endif
 
-static int nf_register_hook_list(struct net *net)
-{
-	struct nf_hook_ops *elem;
-	int ret;
-
-	rtnl_lock();
-	list_for_each_entry(elem, &nf_hook_list, list) {
-		ret = nf_register_net_hook(net, elem);
-		if (ret && ret != -ENOENT)
-			goto out_undo;
-	}
-	rtnl_unlock();
-	return 0;
-
-out_undo:
-	list_for_each_entry_continue_reverse(elem, &nf_hook_list, list)
-		nf_unregister_net_hook(net, elem);
-	rtnl_unlock();
-	return ret;
-}
-
-static void nf_unregister_hook_list(struct net *net)
-{
-	struct nf_hook_ops *elem;
-
-	rtnl_lock();
-	list_for_each_entry(elem, &nf_hook_list, list)
-		nf_unregister_net_hook(net, elem);
-	rtnl_unlock();
-}
-
 static int __net_init netfilter_net_init(struct net *net)
 {
 	int i, h, ret;
@@ -500,16 +361,12 @@ static int __net_init netfilter_net_init(struct net *net)
 		return -ENOMEM;
 	}
 #endif
-	ret = nf_register_hook_list(net);
-	if (ret)
-		remove_proc_entry("netfilter", net->proc_net);
 
 	return ret;
 }
 
 static void __net_exit netfilter_net_exit(struct net *net)
 {
-	nf_unregister_hook_list(net);
 	remove_proc_entry("netfilter", net->proc_net);
 }
 
-- 
2.9.4

Re: [PATCH nf] netfilter: remove old pre-netns era hook api

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 2580 bytes --]

Hi Florian,

[auto build test ERROR on nf/master]

url:    https://github.com/0day-ci/linux/commits/Florian-Westphal/netfilter-remove-old-pre-netns-era-hook-api/20170709-104810
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
config: x86_64-allyesdebian (attached as .config)
compiler: gcc-6 (Debian 6.2.0-3) 6.2.0 20160901
reproduce:
        # save the attached .config to linux build tree
        make ARCH=x86_64 

All errors (new ones prefixed by >>):

   security/selinux/hooks.c: In function 'selinux_nf_ip_init':
>> security/selinux/hooks.c:6459:8: error: implicit declaration of function 'nf_register_hooks' [-Werror=implicit-function-declaration]
     err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
           ^~~~~~~~~~~~~~~~~
   cc1: some warnings being treated as errors
--
   net/ipv4/netfilter/ipt_CLUSTERIP.c: In function 'clusterip_tg_init':
>> net/ipv4/netfilter/ipt_CLUSTERIP.c:789:8: error: implicit declaration of function 'nf_register_hook' [-Werror=implicit-function-declaration]
     ret = nf_register_hook(&cip_arp_ops);
           ^~~~~~~~~~~~~~~~
   net/ipv4/netfilter/ipt_CLUSTERIP.c: In function 'clusterip_tg_exit':
>> net/ipv4/netfilter/ipt_CLUSTERIP.c:809:2: error: implicit declaration of function 'nf_unregister_hook' [-Werror=implicit-function-declaration]
     nf_unregister_hook(&cip_arp_ops);
     ^~~~~~~~~~~~~~~~~~
   cc1: some warnings being treated as errors

vim +/nf_register_hooks +6459 security/selinux/hooks.c

^1da177e Linus Torvalds 2005-04-16  6453  
^1da177e Linus Torvalds 2005-04-16  6454  	if (!selinux_enabled)
25db6bea Jiri Pirko     2014-09-03  6455  		return 0;
^1da177e Linus Torvalds 2005-04-16  6456  
fadcdb45 Eric Paris     2007-02-22  6457  	printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
^1da177e Linus Torvalds 2005-04-16  6458  
25db6bea Jiri Pirko     2014-09-03 @6459  	err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
^1da177e Linus Torvalds 2005-04-16  6460  	if (err)
25db6bea Jiri Pirko     2014-09-03  6461  		panic("SELinux: nf_register_hooks: error %d\n", err);
^1da177e Linus Torvalds 2005-04-16  6462  

:::::: The code at line 6459 was first introduced by commit
:::::: 25db6bea1ff5a78ef493eefdcbb9c1d27134e560 selinux: register nf hooks with single nf_register_hooks call

:::::: TO: Jiri Pirko <jiri@resnulli.us>
:::::: CC: Paul Moore <pmoore@redhat.com>

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 38839 bytes --]

Re: [PATCH nf] netfilter: remove old pre-netns era hook api

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 3471 bytes --]

Hi Florian,

[auto build test ERROR on nf/master]

url:    https://github.com/0day-ci/linux/commits/Florian-Westphal/netfilter-remove-old-pre-netns-era-hook-api/20170709-104810
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
config: i386-allmodconfig (attached as .config)
compiler: gcc-6 (Debian 6.2.0-3) 6.2.0 20160901
reproduce:
        # save the attached .config to linux build tree
        make ARCH=i386 

All errors (new ones prefixed by >>):

   security/selinux/hooks.c: In function 'selinux_nf_ip_init':
   security/selinux/hooks.c:6459:8: error: implicit declaration of function 'nf_register_hooks' [-Werror=implicit-function-declaration]
     err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
           ^~~~~~~~~~~~~~~~~
   security/selinux/hooks.c: In function 'selinux_nf_ip_exit':
>> security/selinux/hooks.c:6473:2: error: implicit declaration of function 'nf_unregister_hooks' [-Werror=implicit-function-declaration]
     nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
     ^~~~~~~~~~~~~~~~~~~
   cc1: some warnings being treated as errors
--
   security/smack/smack_netfilter.c: In function 'smack_nf_ip_init':
>> security/smack/smack_netfilter.c:86:8: error: implicit declaration of function 'nf_register_hooks' [-Werror=implicit-function-declaration]
     err = nf_register_hooks(smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
           ^~~~~~~~~~~~~~~~~
   cc1: some warnings being treated as errors

vim +/nf_unregister_hooks +6473 security/selinux/hooks.c

^1da177e Linus Torvalds 2005-04-16  6453  
^1da177e Linus Torvalds 2005-04-16  6454  	if (!selinux_enabled)
25db6bea Jiri Pirko     2014-09-03  6455  		return 0;
^1da177e Linus Torvalds 2005-04-16  6456  
fadcdb45 Eric Paris     2007-02-22  6457  	printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
^1da177e Linus Torvalds 2005-04-16  6458  
25db6bea Jiri Pirko     2014-09-03 @6459  	err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
^1da177e Linus Torvalds 2005-04-16  6460  	if (err)
25db6bea Jiri Pirko     2014-09-03  6461  		panic("SELinux: nf_register_hooks: error %d\n", err);
^1da177e Linus Torvalds 2005-04-16  6462  
25db6bea Jiri Pirko     2014-09-03  6463  	return 0;
^1da177e Linus Torvalds 2005-04-16  6464  }
^1da177e Linus Torvalds 2005-04-16  6465  
^1da177e Linus Torvalds 2005-04-16  6466  __initcall(selinux_nf_ip_init);
^1da177e Linus Torvalds 2005-04-16  6467  
^1da177e Linus Torvalds 2005-04-16  6468  #ifdef CONFIG_SECURITY_SELINUX_DISABLE
^1da177e Linus Torvalds 2005-04-16  6469  static void selinux_nf_ip_exit(void)
^1da177e Linus Torvalds 2005-04-16  6470  {
fadcdb45 Eric Paris     2007-02-22  6471  	printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
^1da177e Linus Torvalds 2005-04-16  6472  
25db6bea Jiri Pirko     2014-09-03 @6473  	nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
^1da177e Linus Torvalds 2005-04-16  6474  }
^1da177e Linus Torvalds 2005-04-16  6475  #endif
^1da177e Linus Torvalds 2005-04-16  6476  

:::::: The code at line 6473 was first introduced by commit
:::::: 25db6bea1ff5a78ef493eefdcbb9c1d27134e560 selinux: register nf hooks with single nf_register_hooks call

:::::: TO: Jiri Pirko <jiri@resnulli.us>
:::::: CC: Paul Moore <pmoore@redhat.com>

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 60086 bytes --]

Re: [PATCH nf] netfilter: remove old pre-netns era hook api

[Pablo Neira Ayuso]

On Thu, Jul 06, 2017 at 11:17:44PM +0200, Florian Westphal wrote:
> no more users in the tree, remove this.
> 
> The old api is racy wrt. module removal, all users have been converted
> to the netns-aware api.
> 
> The old api pretended we still have global hooks but that has not been
> true for a long time.

Applied, thanks.