[OS-BUILD PATCHv4 0/2] netfilter: Add deprecation notices for xtables

List overview All Threads
Download

newer

older

[OS-BUILD PATCH] RHMAINTAINERS:...

✅ PASS: Test report for kernel...

Phil Sutter (via Email Bridge)

9 Sep 2021 9 Sep '21

3:36 a.m.

From: Phil Sutter on gitlab.com Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1945179

Upstream Status: RHEL-only

Tested: Ported patches to RHEL8 kernel tree (applied with minor conflicts) and tested there. I gave up building kernel-ark in brew after several attempts with changed options, always ending up in compiler errors.

Upon loading legacy xtables table modules or the nft compat module, print a warning.

--- include/linux/kernel.h | 2 ++ kernel/rh_taint.c | 16 ++++++++++++++++ redhat/configs/ark/generic/CONFIG_BRIDGE_NETFILTER | 1 + redhat/configs/ark/generic/CONFIG_BRIDGE_NF_EBTABLES | 2 ++ redhat/configs/ark/generic/CONFIG_IP6_NF_IPTABLES | 2 ++ redhat/configs/ark/generic/CONFIG_IP_NF_ARPTABLES | 2 ++ redhat/configs/ark/generic/CONFIG_IP_NF_IPTABLES | 2 ++ redhat/configs/ark/generic/CONFIG_IP_SET | 2 ++ redhat/configs/ark/generic/CONFIG_NETFILTER_XTABLES | 1 + redhat/configs/ark/generic/CONFIG_NFT_COMPAT | 2 ++ redhat/configs/ark/generic/CONFIG_NF_CONNTRACK_LABELS | 1 + 11 files changed, 33 insertions(+), 0 deletions(-)

Show replies by date

Phil Sutter (via Email Bridge)

9 Sep 9 Sep

3:36 a.m.

New subject: [OS-BUILD PATCHv4 1/2] redhat: Add mark_driver_deprecated()

From: Phil Sutter psutter@redhat.com

redhat: Add mark_driver_deprecated()

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1945179 Upstream Status: RHEL-only

Allow marking drivers deprecated. The printed message is basically identical to what mark_hardware_deprecated() prints but generalized a bit to cover non-hardware drivers also. Semantically, the introduced function aligns with mark_driver_unsupported().

Signed-off-by: Phil Sutter psutter@redhat.com

diff --git a/include/linux/kernel.h b/include/linux/kernel.h index blahblah..blahblah 100644 --- a/include/linux/kernel.h +++ b/include/linux/kernel.h @@ -538,11 +538,13 @@ void mark_hardware_unsupported(const char *msg); void mark_hardware_deprecated(const char *msg); void mark_tech_preview(const char *msg, struct module *mod); void mark_driver_unsupported(const char *name); +void mark_driver_deprecated(const char *name); #else static inline void mark_hardware_unsupported(const char *msg) { } static inline void mark_hardware_deprecated(const char *msg) { } static inline void mark_tech_preview(const char *msg, struct module *mod) { } static inline void mark_driver_unsupported(const char *name) { } +static inline void mark_driver_deprecated(const char *name) { } #endif

#endif diff --git a/kernel/rh_taint.c b/kernel/rh_taint.c index blahblah..blahblah 100644 --- a/kernel/rh_taint.c +++ b/kernel/rh_taint.c @@ -91,3 +91,19 @@ void mark_driver_unsupported(const char *name) name ? name : "kernel"); } EXPORT_SYMBOL(mark_driver_unsupported); + +/** + * mark_driver_deprecated() - Mark drivers as deprecated. + * @name: the name of the driver + * + * Called to minimize the support status of a previously supported driver in + * a minor release. This does not TAINT the kernel. Future + * RHEL major releases may not include this driver. Driver updates and fixes + * will be limited to critical issues in future minor releases. + */ +void mark_driver_deprecated(const char *name) +{ + pr_crit("Warning: %s - this driver is not recommended for new deployments. It continues to be supported in this RHEL release, but it is likely to be removed in the next major release. Driver updates and fixes will be limited to critical issues. Please contact Red Hat Support for additional information.\n", + name ? name : "kernel"); +} +EXPORT_SYMBOL(mark_driver_deprecated);

-- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226

Phil Sutter (via Email Bridge)

3:37 a.m.

New subject: [OS-BUILD PATCHv4 2/2] redhat: configs: Disable xtables and ipset

From: Phil Sutter psutter@redhat.com

redhat: configs: Disable xtables and ipset

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1945179 Upstream Status: RHEL-only

These drivers have been deprecated with RHEL9, so with RHEL10 it is time to remove them:

- CONFIG_BRIDGE_NF_EBTABLES - CONFIG_IP6_NF_IPTABLES - CONFIG_IP_NF_ARPTABLES - CONFIG_IP_NF_IPTABLES - CONFIG_IP_SET - CONFIG_NFT_COMPAT

Enable previous selected symbols to reduce impact to deprecated symbols:

- CONFIG_NF_CONNTRACK_LABELS

Drop symbols not used anymore:

- CONFIG_NETFILTER_XTABLES - CONFIG_BRIDGE_NETFILTER

diff --git a/redhat/configs/ark/generic/CONFIG_BRIDGE_NETFILTER b/redhat/configs/ark/generic/CONFIG_BRIDGE_NETFILTER new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/ark/generic/CONFIG_BRIDGE_NETFILTER @@ -0,0 +1 @@ +# CONFIG_BRIDGE_NETFILTER is not set diff --git a/redhat/configs/ark/generic/CONFIG_BRIDGE_NF_EBTABLES b/redhat/configs/ark/generic/CONFIG_BRIDGE_NF_EBTABLES new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/ark/generic/CONFIG_BRIDGE_NF_EBTABLES @@ -0,0 +1,2 @@ +# This CONFIG has been disabled in RHEL by RHEL Engineering. Please contact Red Hat Support for further assistance. +# CONFIG_BRIDGE_NF_EBTABLES is not set diff --git a/redhat/configs/ark/generic/CONFIG_IP6_NF_IPTABLES b/redhat/configs/ark/generic/CONFIG_IP6_NF_IPTABLES new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/ark/generic/CONFIG_IP6_NF_IPTABLES @@ -0,0 +1,2 @@ +# This CONFIG has been disabled in RHEL by RHEL Engineering. Please contact Red Hat Support for further assistance. +# CONFIG_IP6_NF_IPTABLES is not set diff --git a/redhat/configs/ark/generic/CONFIG_IP_NF_ARPTABLES b/redhat/configs/ark/generic/CONFIG_IP_NF_ARPTABLES new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/ark/generic/CONFIG_IP_NF_ARPTABLES @@ -0,0 +1,2 @@ +# This CONFIG has been disabled in RHEL by RHEL Engineering. Please contact Red Hat Support for further assistance. +# CONFIG_IP_NF_ARPTABLES is not set diff --git a/redhat/configs/ark/generic/CONFIG_IP_NF_IPTABLES b/redhat/configs/ark/generic/CONFIG_IP_NF_IPTABLES new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/ark/generic/CONFIG_IP_NF_IPTABLES @@ -0,0 +1,2 @@ +# This CONFIG has been disabled in RHEL by RHEL Engineering. Please contact Red Hat Support for further assistance. +# CONFIG_IP_NF_IPTABLES is not set diff --git a/redhat/configs/ark/generic/CONFIG_IP_SET b/redhat/configs/ark/generic/CONFIG_IP_SET new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/ark/generic/CONFIG_IP_SET @@ -0,0 +1,2 @@ +# This CONFIG has been disabled in RHEL by RHEL Engineering. Please contact Red Hat Support for further assistance. +# CONFIG_IP_SET is not set diff --git a/redhat/configs/ark/generic/CONFIG_NETFILTER_XTABLES b/redhat/configs/ark/generic/CONFIG_NETFILTER_XTABLES new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/ark/generic/CONFIG_NETFILTER_XTABLES @@ -0,0 +1 @@ +# CONFIG_NETFILTER_XTABLES is not set diff --git a/redhat/configs/ark/generic/CONFIG_NFT_COMPAT b/redhat/configs/ark/generic/CONFIG_NFT_COMPAT new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/ark/generic/CONFIG_NFT_COMPAT @@ -0,0 +1,2 @@ +# This CONFIG has been disabled in RHEL by RHEL Engineering. Please contact Red Hat Support for further assistance. +# CONFIG_NFT_COMPAT is not set diff --git a/redhat/configs/ark/generic/CONFIG_NF_CONNTRACK_LABELS b/redhat/configs/ark/generic/CONFIG_NF_CONNTRACK_LABELS new file mode 100644 index blahblah..blahblah 100644 --- /dev/null +++ b/redhat/configs/ark/generic/CONFIG_NF_CONNTRACK_LABELS @@ -0,0 +1 @@ +CONFIG_NF_CONNTRACK_LABELS=y

-- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1226