net: add CONFIG_NET_INGRESS to enable ingress filtering

This new config switch enables the ingress filtering infrastructure that is
controlled through the ingress_needed static key. This prepares the
introduction of the Netfilter ingress hook that resides under this unique
static key.

Note that CONFIG_SCH_INGRESS automatically selects this, that should be no
problem since this also depends on CONFIG_NET_CLS_ACT.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index bd29ab4b094169f310a0e2057983aa2b874d1e93..a2324fb45cf4242d7165d873c2a0b112b47ebd9c 100644 (file)
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -79,7 +79,7 @@ static inline struct netdev_queue *dev_ingress_queue(struct net_device *dev)
 
 struct netdev_queue *dev_ingress_queue_create(struct net_device *dev);
 
-#ifdef CONFIG_NET_CLS_ACT
+#ifdef CONFIG_NET_INGRESS
 void net_inc_ingress_queue(void);
 void net_dec_ingress_queue(void);
 #endif

diff --git a/net/Kconfig b/net/Kconfig
index 44dd5786ee91da16ae920d3c9f62b1f4bac353c8..57a7c5af3175d1826f0708c551227e5e4281577e 100644 (file)
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -45,6 +45,9 @@ config COMPAT_NETLINK_MESSAGES
          Newly written code should NEVER need this option but do
          compat-independent messages instead!
 
+config NET_INGRESS
+       bool
+
 menu "Networking options"
 
 source "net/packet/Kconfig"

diff --git a/net/core/dev.c b/net/core/dev.c
index af549062ae8e7f725f35a2447818dd427b202657..a5ef90016ce735e4ac8df3c7d83344da87ba3e01 100644 (file)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1630,7 +1630,7 @@ int call_netdevice_notifiers(unsigned long val, struct net_device *dev)
 }
 EXPORT_SYMBOL(call_netdevice_notifiers);
 
-#ifdef CONFIG_NET_CLS_ACT
+#ifdef CONFIG_NET_INGRESS
 static struct static_key ingress_needed __read_mostly;
 
 void net_inc_ingress_queue(void)
@@ -3798,13 +3798,14 @@ another_round:
        }
 
 skip_taps:
-#ifdef CONFIG_NET_CLS_ACT
+#ifdef CONFIG_NET_INGRESS
        if (static_key_false(&ingress_needed)) {
                skb = handle_ing(skb, &pt_prev, &ret, orig_dev);
                if (!skb)
                        goto unlock;
        }
-
+#endif
+#ifdef CONFIG_NET_CLS_ACT
        skb->tc_verd = 0;
 ncls:
 #endif

diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 5fd1c2f487d26cdb848a401e5532455644531dac..daa33432b7166e1c9af818835441be1b102d8d73 100644 (file)
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -312,6 +312,7 @@ config NET_SCH_PIE
 config NET_SCH_INGRESS
        tristate "Ingress Qdisc"
        depends on NET_CLS_ACT
+       select NET_INGRESS
        ---help---
          Say Y here if you want to use classifiers for incoming packets.
          If unsure, say Y.