From: Phil Sutter on gitlab.com Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1945179 Upstream Status: RHEL-only Tested: In local VM, using instructions from BZ.
Upon loading legacy xtables table modules or the nft compat module, print a warning suggesting nftables.
--- include/linux/kernel.h | 2 ++ kernel/rh_taint.c | 16 ++++++++++++++++ net/bridge/netfilter/ebtables.c | 2 ++ net/ipv4/netfilter/arp_tables.c | 2 ++ net/ipv4/netfilter/ip_tables.c | 2 ++ net/ipv6/netfilter/ip6_tables.c | 2 ++ net/netfilter/ipset/ip_set_core.c | 7 ++++++- net/netfilter/nft_compat.c | 4 ++++ 8 files changed, 36 insertions(+), 1 deletions(-)
From: Phil Sutter psutter@redhat.com
redhat: Add mark_driver_deprecated()
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1945179 Upstream Status: RHEL-only
Allow marking drivers deprecated. The printed message is basically identical to what mark_hardware_deprecated() prints but generalized a bit to cover non-hardware drivers also. Semantically, the introduced function aligns with mark_driver_unsupported().
Signed-off-by: Phil Sutter psutter@redhat.com
diff --git a/include/linux/kernel.h b/include/linux/kernel.h index blahblah..blahblah 100644 --- a/include/linux/kernel.h +++ b/include/linux/kernel.h @@ -538,11 +538,13 @@ void mark_hardware_unsupported(const char *msg); void mark_hardware_deprecated(const char *msg); void mark_tech_preview(const char *msg, struct module *mod); void mark_driver_unsupported(const char *name); +void mark_driver_deprecated(const char *name); #else static inline void mark_hardware_unsupported(const char *msg) { } static inline void mark_hardware_deprecated(const char *msg) { } static inline void mark_tech_preview(const char *msg, struct module *mod) { } static inline void mark_driver_unsupported(const char *name) { } +static inline void mark_driver_deprecated(const char *name) { } #endif
#endif diff --git a/kernel/rh_taint.c b/kernel/rh_taint.c index blahblah..blahblah 100644 --- a/kernel/rh_taint.c +++ b/kernel/rh_taint.c @@ -91,3 +91,19 @@ void mark_driver_unsupported(const char *name) name ? name : "kernel"); } EXPORT_SYMBOL(mark_driver_unsupported); + +/** + * mark_driver_deprecated() - Mark drivers as deprecated. + * @name: the name of the driver + * + * Called to minimize the support status of a previously supported driver in + * a minor release. This does not TAINT the kernel. Future + * RHEL major releases may not include this driver. Driver updates and fixes + * will be limited to critical issues in future minor releases. + */ +void mark_driver_deprecated(const char *name) +{ + pr_crit("Warning: %s - this driver is not recommended for new deployments. It continues to be supported in this RHEL release, but it is likely to be removed in the next major release. Driver updates and fixes will be limited to critical issues. Please contact Red Hat Support for additional information.\n", + name ? name : "kernel"); +} +EXPORT_SYMBOL(mark_driver_deprecated);
-- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226
From: Phil Sutter psutter@redhat.com
netfilter: Add deprecation notices for xtables
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1945179 Upstream Status: RHEL-only
Upon loading legacy xtables table modules or the nft compat module, print a warning indicating deprecation status.
Signed-off-by: Phil Sutter psutter@redhat.com
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c index blahblah..blahblah 100644 --- a/net/bridge/netfilter/ebtables.c +++ b/net/bridge/netfilter/ebtables.c @@ -2565,6 +2565,8 @@ static int __init ebtables_init(void) { int ret;
+ mark_driver_deprecated("ebtables"); + ret = xt_register_target(&ebt_standard_target); if (ret < 0) return ret; diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c index blahblah..blahblah 100644 --- a/net/ipv4/netfilter/arp_tables.c +++ b/net/ipv4/netfilter/arp_tables.c @@ -1623,6 +1623,8 @@ static int __init arp_tables_init(void) { int ret;
+ mark_driver_deprecated("arptables"); + ret = register_pernet_subsys(&arp_tables_net_ops); if (ret < 0) goto err1; diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index blahblah..blahblah 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -1902,6 +1902,8 @@ static int __init ip_tables_init(void) { int ret;
+ mark_driver_deprecated("iptables"); + ret = register_pernet_subsys(&ip_tables_net_ops); if (ret < 0) goto err1; diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c index blahblah..blahblah 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c @@ -1909,6 +1909,8 @@ static int __init ip6_tables_init(void) { int ret;
+ mark_driver_deprecated("ip6tables"); + ret = register_pernet_subsys(&ip6_tables_net_ops); if (ret < 0) goto err1; diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c index blahblah..blahblah 100644 --- a/net/netfilter/ipset/ip_set_core.c +++ b/net/netfilter/ipset/ip_set_core.c @@ -6,6 +6,8 @@
/* Kernel module for IP set management */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + #include <linux/init.h> #include <linux/module.h> #include <linux/moduleparam.h> @@ -2362,8 +2364,11 @@ static struct pernet_operations ip_set_net_ops = { static int __init ip_set_init(void) { - int ret = register_pernet_subsys(&ip_set_net_ops); + int ret; + + mark_driver_deprecated("ipset");
+ ret = register_pernet_subsys(&ip_set_net_ops); if (ret) { pr_err("ip_set: cannot register pernet_subsys.\n"); return ret; diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c index blahblah..blahblah 100644 --- a/net/netfilter/nft_compat.c +++ b/net/netfilter/nft_compat.c @@ -5,6 +5,8 @@ * This software has been sponsored by Sophos Astaro http://www.sophos.com */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + #include <linux/kernel.h> #include <linux/init.h> #include <linux/module.h> @@ -880,6 +882,8 @@ static int __init nft_compat_module_init(void) { int ret;
+ mark_driver_deprecated("nft_compat"); + ret = nft_register_expr(&nft_match_type); if (ret < 0) return ret;
-- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226
From: Phil Sutter on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226#note_6693005...
Eric suggested to build from dist-git repo instead which actually worked pretty well:
https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=39538192
I tested the kernel in 1minutetip, kernel messages are printed upon loading of ip_tables, ip6_tables, ip_set and nft_compat modules.
From: Phil Sutter on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226#note_6723090...
@prarit, are you OK with the new version?
From: Prarit Bhargava on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226#note_6724115...
Hey @psutter1,
Things have progressed since you posted this two months ago. RHEL9 has had it's final rebase against ARK, and is now it's own tree: https://gitlab.com/redhat/rhel/src/kernel/rhel-9.
Here's what you should now do:
1. Use this MR to submit the deprecation code into ARK *and* disable the CONFIGS for iptables, etc. For those CONFIGs add a comment in the CONFIG file that states: "This CONFIG has been disabled in RHEL by RHEL Engineering. Please contact Red Hat Support for further assistance."
2. Submit *this* MR to the RHEL9 repository so iptables are appropriately marked deprecated in RHEL9.
I do realize this is a bit of extra work, however, we're figuring some of this out as we move along.
From: Phil Sutter on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226#note_6724770...
I see. So kernel-ark is collecting kernel changes for RHEL10 since RHEL9's final rebase?
From: Phil Sutter on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226#note_6725046...
OK, so I created another MR for rhel9 repo, aiming at 'main' branch. Is that correct @prarit ? Or do we really use a separate tree for beta? There is 9.0-beta but it differs only in .gitlab-ci.yml file.
From: Prarit Bhargava on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226#note_6725664...
@psutter1 -- I just sent you an email :)
From: Prarit Bhargava on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226#note_6726628...
This looks good to me and matches the rest of the existing messages. If we need to change these later on we can make a modification after management approval.
From: Phil Sutter on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226#note_6726850...
Cool, thanks for the review. I updated the RHEL9 MR already to face 9.0-beta branch. Will rebase this one to only contain the first patch and a new one disabling the relevant config symbols as discussed today.
kernel@lists.fedoraproject.org
-
Phil Sutter (via Email Bridge) -
Prarit Bhargava (via Email Bridge)