Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
linux/net/netfilter
History
Pablo Neira Ayuso b4e70d8dd9 netfilter: nftables: add set expression flags 
The set flag NFT_SET_EXPR provides a hint to the kernel that userspace
supports for multiple expressions per set element. In the same
direction, NFT_DYNSET_F_EXPR specifies that dynset expression defines
multiple expressions per set element.

This allows new userspace software with old kernels to bail out with
EOPNOTSUPP. This update is similar to ef516e8625 ("netfilter:
nf_tables: reintroduce the NFT_SET_CONCAT flag"). The NFT_SET_EXPR flag
needs to be set on when the NFTA_SET_EXPRESSIONS attribute is specified.
The NFT_SET_EXPR flag is not set on with NFTA_SET_EXPR to retain
backward compatibility in old userspace binaries.

Fixes: 48b0ae046e ("netfilter: nftables: netlink support for several set element expressions")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
 		2020-12-28 10:50:26 +01:00
..
ipset netfilter: ipset: fix shift-out-of-bounds in htable_bits() 2020-12-17 19:44:52 +01:00
ipvs Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2020-12-14 15:43:21 -08:00
Kconfig netfilter: nft_reject: add reject verdict support for netdev 2020-10-31 10:41:00 +01:00
Makefile netfilter: nft_reject: add reject verdict support for netdev 2020-10-31 10:41:00 +01:00
core.c netfilter: add inet ingress support 2020-10-12 01:57:34 +02:00
nf_conncount.c
…
nf_conntrack_acct.c
…
nf_conntrack_amanda.c
…
nf_conntrack_broadcast.c
…
nf_conntrack_core.c netfilter: conntrack: remove unneeded nf_ct_put 2020-08-28 19:51:27 +02:00
nf_conntrack_ecache.c
…
nf_conntrack_expect.c
…
nf_conntrack_extend.c
…
nf_conntrack_ftp.c treewide: Remove uninitialized_var() usage 2020-07-16 12:35:15 -07:00
nf_conntrack_h323_asn1.c netfilter: Use fallthrough pseudo-keyword 2020-07-22 01:18:05 +02:00
nf_conntrack_h323_main.c
…
nf_conntrack_h323_types.c
…
nf_conntrack_helper.c
…
nf_conntrack_irc.c
…
nf_conntrack_labels.c
…
nf_conntrack_netbios_ns.c
…
nf_conntrack_netlink.c netfilter: ctnetlink: add timeout and protoinfo to destroy events 2020-12-12 11:44:42 +01:00
nf_conntrack_pptp.c netfilter: delete repeated words 2020-08-28 20:11:38 +02:00
nf_conntrack_proto.c netfilter: conntrack: nf_conncount_init is failing with IPv6 disabled 2020-09-08 13:04:54 +02:00
nf_conntrack_proto_dccp.c netfilter: ctnetlink: add timeout and protoinfo to destroy events 2020-12-12 11:44:42 +01:00
nf_conntrack_proto_generic.c
…
nf_conntrack_proto_gre.c
…
nf_conntrack_proto_icmp.c netfilter: ctnetlink: add kernel side filtering for dump 2020-05-27 22:20:34 +02:00
nf_conntrack_proto_icmpv6.c netfilter: ctnetlink: add kernel side filtering for dump 2020-05-27 22:20:34 +02:00
nf_conntrack_proto_sctp.c netfilter: ctnetlink: add timeout and protoinfo to destroy events 2020-12-12 11:44:42 +01:00
nf_conntrack_proto_tcp.c netfilter: ctnetlink: add timeout and protoinfo to destroy events 2020-12-12 11:44:42 +01:00
nf_conntrack_proto_udp.c netfilter: conntrack: do not auto-delete clash entries on reply 2020-08-29 13:03:06 +02:00
nf_conntrack_sane.c
…
nf_conntrack_seqadj.c
…
nf_conntrack_sip.c
…
nf_conntrack_snmp.c
…
nf_conntrack_standalone.c netfilter: conntrack: proc: rename stat column 2020-09-22 01:33:35 +02:00
nf_conntrack_tftp.c
…
nf_conntrack_timeout.c
…
nf_conntrack_timestamp.c
…
nf_dup_netdev.c netfilter: nf_fwd_netdev: clear timestamp in forwarding path 2020-10-22 14:49:36 +02:00
nf_flow_table_core.c netfilter: flowtable: reduce calls to pskb_may_pull() 2020-10-12 01:58:10 +02:00
nf_flow_table_inet.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nf_flow_table_ip.c netfilter: flowtable: reduce calls to pskb_may_pull() 2020-10-12 01:58:10 +02:00
nf_flow_table_offload.c net: sched: Pass qdisc reference in struct flow_block_offload 2020-07-13 17:22:21 -07:00
nf_internals.h netfilter: ctnetlink: add kernel side filtering for dump 2020-05-27 22:20:34 +02:00
nf_log.c sysctl: pass kernel pointers to ->proc_handler 2020-04-27 02:07:40 -04:00
nf_log_common.c netfilter: nf_log: missing vlan offload tag and proto 2020-10-14 01:25:14 +02:00
nf_log_netdev.c
…
nf_nat_amanda.c
…
nf_nat_core.c netfilter: Use fallthrough pseudo-keyword 2020-07-22 01:18:05 +02:00
nf_nat_ftp.c
…
nf_nat_helper.c
…
nf_nat_irc.c
…
nf_nat_masquerade.c
…
nf_nat_proto.c netfilter: use actual socket sk rather than skb sk when routing harder 2020-10-30 12:57:39 +01:00
nf_nat_redirect.c
…
nf_nat_sip.c
…
nf_nat_tftp.c
…
nf_queue.c netfilter: nf_queue: prefer nf_queue_entry_free 2020-03-29 16:28:29 +02:00
nf_sockopt.c netfilter: switch nf_setsockopt to sockptr_t 2020-07-24 15:41:54 -07:00
nf_synproxy_core.c selinux/stable-5.11 PR 20201214 2020-12-16 11:01:04 -08:00
nf_tables_api.c netfilter: nftables: add set expression flags 2020-12-28 10:50:26 +01:00
nf_tables_core.c netfilter: nf_tables: Implement fast bitwise expression 2020-10-04 21:08:33 +02:00
nf_tables_offload.c netfilter: nftables_offload: set address type in control dissector 2020-11-27 12:10:46 +01:00
nf_tables_trace.c
…
nfnetlink.c netfilter: nf_tables: missing validation from the abort path 2020-10-30 12:57:39 +01:00
nfnetlink_acct.c netfilter: nfnl_acct: remove data from struct net 2020-12-01 09:45:29 +01:00
nfnetlink_cthelper.c treewide: rename nla_strlcpy to nla_strscpy. 2020-11-16 08:08:54 -08:00
nfnetlink_cttimeout.c netfilter: Use fallthrough pseudo-keyword 2020-07-22 01:18:05 +02:00
nfnetlink_log.c netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS 2020-08-28 20:11:58 +02:00
nfnetlink_osf.c netfilter: nf_osf: avoid passing pointer to local var 2020-04-29 21:17:57 +02:00
nfnetlink_queue.c netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS 2020-08-28 20:11:58 +02:00
nft_bitwise.c netfilter: nf_tables: Implement fast bitwise expression 2020-10-04 21:08:33 +02:00
nft_byteorder.c
…
nft_chain_filter.c netfilter: nf_tables: add inet ingress support 2020-10-12 01:57:34 +02:00
nft_chain_nat.c netfilter: nft_chain_nat: inet family is missing module ownership 2020-03-06 18:00:43 +01:00
nft_chain_route.c netfilter: use actual socket sk rather than skb sk when routing harder 2020-10-30 12:57:39 +01:00
nft_cmp.c netfilter: nftables_offload: build mask based from the matching bytes 2020-11-27 12:10:47 +01:00
nft_compat.c netfilter: nft_compat: remove flush counter optimization 2020-08-10 13:03:36 +02:00
nft_connlimit.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_counter.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_ct.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-12-11 22:29:38 -08:00
nft_dup_netdev.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_dynset.c netfilter: nftables: add set expression flags 2020-12-28 10:50:26 +01:00
nft_exthdr.c netfilter: nf_tables: nft_exthdr: the presence return value should be little-endian 2020-08-10 13:02:43 +02:00
nft_fib.c netfilter: Use fallthrough pseudo-keyword 2020-07-22 01:18:05 +02:00
nft_fib_inet.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_fib_netdev.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_flow_offload.c netfilter: conntrack: do not auto-delete clash entries on reply 2020-08-29 13:03:06 +02:00
nft_fwd_netdev.c netfilter: nf_fwd_netdev: clear timestamp in forwarding path 2020-10-22 14:49:36 +02:00
nft_hash.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_immediate.c netfilter: nf_tables: Fix a use after free in nft_immediate_destroy() 2020-07-15 20:15:19 +02:00
nft_limit.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_log.c treewide: rename nla_strlcpy to nla_strscpy. 2020-11-16 08:08:54 -08:00
nft_lookup.c netfilter: nf_tables: do not update stateful expressions if lookup is inverted 2020-04-05 23:26:36 +02:00
nft_masq.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_meta.c netfilter: nftables_offload: build mask based from the matching bytes 2020-11-27 12:10:47 +01:00
nft_nat.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_numgen.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_objref.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_osf.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_payload.c netfilter: nftables_offload: build mask based from the matching bytes 2020-11-27 12:10:47 +01:00
nft_queue.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_quota.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_range.c
…
nft_redir.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_reject.c netfilter: nft_reject: unify reject init and dump into nft_reject 2020-10-31 10:40:42 +01:00
nft_reject_inet.c netfilter: use actual socket sk for REJECT action 2020-12-01 14:33:55 +01:00
nft_reject_netdev.c netfilter: nft_reject: add reject verdict support for netdev 2020-10-31 10:41:00 +01:00
nft_rt.c
…
nft_set_bitmap.c netfilter: nf_tables: do not update stateful expressions if lookup is inverted 2020-04-05 23:26:36 +02:00
nft_set_hash.c netfilter: nftables: generalize set extension to support for several expressions 2020-12-12 19:20:24 +01:00
nft_set_pipapo.c netfilter: Replace HTTP links with HTTPS ones 2020-07-29 20:09:18 +02:00
nft_set_pipapo.h nft_set_pipapo: Prepare for single ranged field usage 2020-03-15 15:27:46 +01:00
nft_set_pipapo_avx2.c nft_set_pipapo: Prepare for single ranged field usage 2020-03-15 15:27:46 +01:00
nft_set_pipapo_avx2.h x86: update AS_* macros to binutils >=2.23, supporting ADX and AVX2 2020-04-09 00:12:48 +09:00
nft_set_rbtree.c netfilter: nft_set_rbtree: Detect partial overlap with start endpoint match 2020-08-21 17:37:36 +02:00
nft_socket.c netfilter: nft_socket: add wildcard support 2020-08-29 13:04:44 +02:00
nft_synproxy.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_tproxy.c
…
nft_tunnel.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_xfrm.c
…
utils.c netfilter: use actual socket sk rather than skb sk when routing harder 2020-10-30 12:57:39 +01:00
x_tables.c netfilter: x_tables: Switch synchronization to RCU 2020-12-08 12:57:39 +01:00
xt_AUDIT.c
…
xt_CHECKSUM.c
…
xt_CLASSIFY.c
…
xt_CONNSECMARK.c netfilter: Replace HTTP links with HTTPS ones 2020-07-29 20:09:18 +02:00
xt_CT.c
…
xt_DSCP.c
…
xt_HL.c
…
xt_HMARK.c netfilter: xt_HMARK: Use ip_is_fragment() helper 2020-08-28 19:55:51 +02:00
xt_IDLETIMER.c netfilter: xt_IDLETIMER: target v1 - match Android layout 2020-04-05 23:26:37 +02:00
xt_LED.c
…
xt_LOG.c
…
xt_MASQUERADE.c
…
xt_NETMAP.c
…
xt_NFLOG.c
…
xt_NFQUEUE.c
…
xt_RATEEST.c netfilter: xt_RATEEST: reject non-null terminated string from userspace 2020-12-27 11:52:26 +01:00
xt_REDIRECT.c
…
xt_SECMARK.c netfilter: cleanup unused macro 2020-03-15 15:20:16 +01:00
xt_TCPMSS.c
…
xt_TCPOPTSTRIP.c
…
xt_TEE.c
…
xt_TPROXY.c
…
xt_TRACE.c
…
xt_addrtype.c
…
xt_bpf.c
…
xt_cgroup.c
…
xt_cluster.c
…
xt_comment.c
…
xt_connbytes.c
…
xt_connlabel.c
…
xt_connlimit.c
…
xt_connmark.c netfilter: Replace HTTP links with HTTPS ones 2020-07-29 20:09:18 +02:00
xt_conntrack.c
…
xt_cpu.c
…
xt_dccp.c
…
xt_devgroup.c
…
xt_dscp.c
…
xt_ecn.c
…
xt_esp.c
…
xt_hashlimit.c netfilter: Replace zero-length array with flexible-array member 2020-03-15 15:20:16 +01:00
xt_helper.c
…
xt_hl.c
…
xt_ipcomp.c
…
xt_iprange.c
…
xt_ipvs.c
…
xt_l2tp.c
…
xt_length.c
…
xt_limit.c
…
xt_mac.c
…
xt_mark.c
…
xt_multiport.c
…
xt_nat.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
xt_nfacct.c netfilter: Remove unnecessary conversion to bool 2020-12-01 09:45:29 +01:00
xt_osf.c
…
xt_owner.c
…
xt_physdev.c
…
xt_pkttype.c
…
xt_policy.c
…
xt_quota.c
…
xt_rateest.c
…
xt_realm.c
…
xt_recent.c netfilter: delete repeated words 2020-08-28 20:11:38 +02:00
xt_repldata.h
…
xt_sctp.c
…
xt_set.c
…
xt_socket.c
…
xt_state.c
…
xt_statistic.c
…
xt_string.c
…
xt_tcpmss.c
…
xt_tcpudp.c
…
xt_time.c netfilter: Replace HTTP links with HTTPS ones 2020-07-29 20:09:18 +02:00
xt_u32.c
…