• Pablo Neira Ayuso's avatar
    netfilter: bridge: move br_netfilter out of the core · 34666d46
    Pablo Neira Ayuso authored
    
    
    Jesper reported that br_netfilter always registers the hooks since
    this is part of the bridge core. This harms performance for people that
    don't need this.
    
    This patch modularizes br_netfilter so it can be rmmod'ed, thus,
    the hooks can be unregistered. I think the bridge netfilter should have
    been a separated module since the beginning, Patrick agreed on that.
    
    Note that this is breaking compatibility for users that expect that
    bridge netfilter is going to be available after explicitly 'modprobe
    bridge' or via automatic load through brctl.
    
    However, the damage can be easily undone by modprobing br_netfilter.
    The bridge core also spots a message to provide a clue to people that
    didn't notice that this has been deprecated.
    
    On top of that, the plan is that nftables will not rely on this software
    layer, but integrate the connection tracking into the bridge layer to
    enable stateful filtering and NAT, which is was bridge netfilter users
    seem to require.
    
    This patch still keeps the fake_dst_ops in the bridge core, since this
    is required by when the bridge port is initialized. So we can safely
    modprobe/rmmod br_netfilter anytime.
    
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    Acked-by: default avatarFlorian Westphal <fw@strlen.de>
    34666d46