You've already forked linux-apfs
mirror of
https://github.com/linux-apfs/linux-apfs.git
synced 2026-05-01 15:00:59 -07:00
netfilter: remove ip_queue support
This patch removes ip_queue support which was marked as obsolete years ago. The nfnetlink_queue modules provides more advanced user-space packet queueing mechanism. This patch also removes capability code included in SELinux that refers to ip_queue. Otherwise, we break compilation. Several warning has been sent regarding this to the mailing list in the past month without anyone rising the hand to stop this with some strong argument. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso
@@ -0,0 +1,9 @@
|
||||
What: ip_queue
|
||||
Date: finally removed in kernel v3.5.0
|
||||
Contact: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
Description:
|
||||
ip_queue has been replaced by nfnetlink_queue which provides
|
||||
more advanced queueing mechanism to user-space. The ip_queue
|
||||
module was already announced to become obsolete years ago.
|
||||
|
||||
Users:
|
||||
@@ -1,4 +1,3 @@
|
||||
header-y += ip_queue.h
|
||||
header-y += ip_tables.h
|
||||
header-y += ipt_CLUSTERIP.h
|
||||
header-y += ipt_ECN.h
|
||||
|
||||
@@ -1,72 +0,0 @@
|
||||
/*
|
||||
* This is a module which is used for queueing IPv4 packets and
|
||||
* communicating with userspace via netlink.
|
||||
*
|
||||
* (C) 2000 James Morris, this code is GPL.
|
||||
*/
|
||||
#ifndef _IP_QUEUE_H
|
||||
#define _IP_QUEUE_H
|
||||
|
||||
#ifdef __KERNEL__
|
||||
#ifdef DEBUG_IPQ
|
||||
#define QDEBUG(x...) printk(KERN_DEBUG ## x)
|
||||
#else
|
||||
#define QDEBUG(x...)
|
||||
#endif /* DEBUG_IPQ */
|
||||
#else
|
||||
#include <net/if.h>
|
||||
#endif /* ! __KERNEL__ */
|
||||
|
||||
/* Messages sent from kernel */
|
||||
typedef struct ipq_packet_msg {
|
||||
unsigned long packet_id; /* ID of queued packet */
|
||||
unsigned long mark; /* Netfilter mark value */
|
||||
long timestamp_sec; /* Packet arrival time (seconds) */
|
||||
long timestamp_usec; /* Packet arrvial time (+useconds) */
|
||||
unsigned int hook; /* Netfilter hook we rode in on */
|
||||
char indev_name[IFNAMSIZ]; /* Name of incoming interface */
|
||||
char outdev_name[IFNAMSIZ]; /* Name of outgoing interface */
|
||||
__be16 hw_protocol; /* Hardware protocol (network order) */
|
||||
unsigned short hw_type; /* Hardware type */
|
||||
unsigned char hw_addrlen; /* Hardware address length */
|
||||
unsigned char hw_addr[8]; /* Hardware address */
|
||||
size_t data_len; /* Length of packet data */
|
||||
unsigned char payload[0]; /* Optional packet data */
|
||||
} ipq_packet_msg_t;
|
||||
|
||||
/* Messages sent from userspace */
|
||||
typedef struct ipq_mode_msg {
|
||||
unsigned char value; /* Requested mode */
|
||||
size_t range; /* Optional range of packet requested */
|
||||
} ipq_mode_msg_t;
|
||||
|
||||
typedef struct ipq_verdict_msg {
|
||||
unsigned int value; /* Verdict to hand to netfilter */
|
||||
unsigned long id; /* Packet ID for this verdict */
|
||||
size_t data_len; /* Length of replacement data */
|
||||
unsigned char payload[0]; /* Optional replacement packet */
|
||||
} ipq_verdict_msg_t;
|
||||
|
||||
typedef struct ipq_peer_msg {
|
||||
union {
|
||||
ipq_verdict_msg_t verdict;
|
||||
ipq_mode_msg_t mode;
|
||||
} msg;
|
||||
} ipq_peer_msg_t;
|
||||
|
||||
/* Packet delivery modes */
|
||||
enum {
|
||||
IPQ_COPY_NONE, /* Initial mode, packets are dropped */
|
||||
IPQ_COPY_META, /* Copy metadata */
|
||||
IPQ_COPY_PACKET /* Copy metadata + packet (range) */
|
||||
};
|
||||
#define IPQ_COPY_MAX IPQ_COPY_PACKET
|
||||
|
||||
/* Types of messages */
|
||||
#define IPQM_BASE 0x10 /* standard netlink messages below this */
|
||||
#define IPQM_MODE (IPQM_BASE + 1) /* Mode request from peer */
|
||||
#define IPQM_VERDICT (IPQM_BASE + 2) /* Verdict from peer */
|
||||
#define IPQM_PACKET (IPQM_BASE + 3) /* Packet from kernel */
|
||||
#define IPQM_MAX (IPQM_BASE + 4)
|
||||
|
||||
#endif /*_IP_QUEUE_H*/
|
||||
@@ -7,7 +7,7 @@
|
||||
#define NETLINK_ROUTE 0 /* Routing/device hook */
|
||||
#define NETLINK_UNUSED 1 /* Unused number */
|
||||
#define NETLINK_USERSOCK 2 /* Reserved for user mode socket protocols */
|
||||
#define NETLINK_FIREWALL 3 /* Firewalling hook */
|
||||
#define NETLINK_FIREWALL 3 /* Unused number, formerly ip_queue */
|
||||
#define NETLINK_SOCK_DIAG 4 /* socket monitoring */
|
||||
#define NETLINK_NFLOG 5 /* netfilter/iptables ULOG */
|
||||
#define NETLINK_XFRM 6 /* ipsec */
|
||||
|
||||
@@ -66,6 +66,3 @@ obj-$(CONFIG_IP_NF_ARP_MANGLE) += arpt_mangle.o
|
||||
|
||||
# just filtering instance of ARP tables for now
|
||||
obj-$(CONFIG_IP_NF_ARPFILTER) += arptable_filter.o
|
||||
|
||||
obj-$(CONFIG_IP_NF_QUEUE) += ip_queue.o
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -25,28 +25,6 @@ config NF_CONNTRACK_IPV6
|
||||
|
||||
To compile it as a module, choose M here. If unsure, say N.
|
||||
|
||||
config IP6_NF_QUEUE
|
||||
tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
|
||||
depends on INET && IPV6 && NETFILTER
|
||||
depends on NETFILTER_ADVANCED
|
||||
---help---
|
||||
|
||||
This option adds a queue handler to the kernel for IPv6
|
||||
packets which enables users to receive the filtered packets
|
||||
with QUEUE target using libipq.
|
||||
|
||||
This option enables the old IPv6-only "ip6_queue" implementation
|
||||
which has been obsoleted by the new "nfnetlink_queue" code (see
|
||||
CONFIG_NETFILTER_NETLINK_QUEUE).
|
||||
|
||||
(C) Fernando Anton 2001
|
||||
IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
|
||||
Universidad Carlos III de Madrid
|
||||
Universidad Politecnica de Alcala de Henares
|
||||
email: <fanton@it.uc3m.es>.
|
||||
|
||||
To compile it as a module, choose M here. If unsure, say N.
|
||||
|
||||
config IP6_NF_IPTABLES
|
||||
tristate "IP6 tables support (required for filtering)"
|
||||
depends on INET && IPV6
|
||||
|
||||
@@ -6,7 +6,6 @@
|
||||
obj-$(CONFIG_IP6_NF_IPTABLES) += ip6_tables.o
|
||||
obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
|
||||
obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
|
||||
obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
|
||||
obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
|
||||
obj-$(CONFIG_IP6_NF_SECURITY) += ip6table_security.o
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -14,7 +14,6 @@
|
||||
#include <linux/netlink.h>
|
||||
#include <linux/rtnetlink.h>
|
||||
#include <linux/if.h>
|
||||
#include <linux/netfilter_ipv4/ip_queue.h>
|
||||
#include <linux/inet_diag.h>
|
||||
#include <linux/xfrm.h>
|
||||
#include <linux/audit.h>
|
||||
@@ -70,12 +69,6 @@ static struct nlmsg_perm nlmsg_route_perms[] =
|
||||
{ RTM_SETDCB, NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
|
||||
};
|
||||
|
||||
static struct nlmsg_perm nlmsg_firewall_perms[] =
|
||||
{
|
||||
{ IPQM_MODE, NETLINK_FIREWALL_SOCKET__NLMSG_WRITE },
|
||||
{ IPQM_VERDICT, NETLINK_FIREWALL_SOCKET__NLMSG_WRITE },
|
||||
};
|
||||
|
||||
static struct nlmsg_perm nlmsg_tcpdiag_perms[] =
|
||||
{
|
||||
{ TCPDIAG_GETSOCK, NETLINK_TCPDIAG_SOCKET__NLMSG_READ },
|
||||
@@ -145,12 +138,6 @@ int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm)
|
||||
sizeof(nlmsg_route_perms));
|
||||
break;
|
||||
|
||||
case SECCLASS_NETLINK_FIREWALL_SOCKET:
|
||||
case SECCLASS_NETLINK_IP6FW_SOCKET:
|
||||
err = nlmsg_perm(nlmsg_type, perm, nlmsg_firewall_perms,
|
||||
sizeof(nlmsg_firewall_perms));
|
||||
break;
|
||||
|
||||
case SECCLASS_NETLINK_TCPDIAG_SOCKET:
|
||||
err = nlmsg_perm(nlmsg_type, perm, nlmsg_tcpdiag_perms,
|
||||
sizeof(nlmsg_tcpdiag_perms));
|
||||
|
||||
Reference in New Issue
Block a user