Pablo Neira Ayuso 6001a930ce netfilter: nftables: introduce table ownership ... A userspace daemon like firewalld might need to monitor for netlink updates to detect its ruleset removal by the (global) flush ruleset command to ensure ruleset persistency. This adds extra complexity from userspace and, for some little time, the firewall policy is not in place. This patch adds the NFT_TABLE_F_OWNER flag which allows a userspace program to own the table that creates in exclusivity. Tables that are owned... - can only be updated and removed by the owner, non-owners hit EPERM if they try to update it or remove it. - are destroyed when the owner closes the netlink socket or the process is gone (implicit netlink socket closure). - are skipped by the global flush ruleset command. - are listed in the global ruleset. The userspace process that sets on the NFT_TABLE_F_OWNER flag need to leave open the netlink socket. A new NFTA_TABLE_OWNER netlink attribute specifies the netlink port ID to identify the owner from userspace. This patch also updates error reporting when an unknown table flag is specified to change it from EINVAL to EOPNOTSUPP given that EINVAL is usually reserved to report for malformed netlink messages to userspace. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2021-02-15 18:17:15 +01:00
..
ipset	netfilter: ipset: fix shift-out-of-bounds in htable_bits()	2020-12-17 19:44:52 +01:00
ipvs	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2021-02-06 15:34:23 -08:00
Kconfig	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
Makefile	netfilter: nft_reject: add reject verdict support for netdev	2020-10-31 10:41:00 +01:00
core.c	netfilter: add inet ingress support	2020-10-12 01:57:34 +02:00
nf_conncount.c	…
nf_conntrack_acct.c	…
nf_conntrack_amanda.c	…
nf_conntrack_broadcast.c	…
nf_conntrack_core.c	netfilter: conntrack: skip identical origin tuple in same zone only	2021-02-09 00:04:14 +01:00
nf_conntrack_ecache.c	…
nf_conntrack_expect.c	…
nf_conntrack_extend.c	…
nf_conntrack_ftp.c	…
nf_conntrack_h323_asn1.c	…
nf_conntrack_h323_main.c	…
nf_conntrack_h323_types.c	…
nf_conntrack_helper.c	…
nf_conntrack_irc.c	…
nf_conntrack_labels.c	…
nf_conntrack_netbios_ns.c	…
nf_conntrack_netlink.c	netfilter: ctnetlink: remove get_ct indirection	2021-01-25 22:06:11 +01:00
nf_conntrack_pptp.c	netfilter: delete repeated words	2020-08-28 20:11:38 +02:00
nf_conntrack_proto.c	netfilter: conntrack: nf_conncount_init is failing with IPv6 disabled	2020-09-08 13:04:54 +02:00
nf_conntrack_proto_dccp.c	netfilter: ctnetlink: add timeout and protoinfo to destroy events	2020-12-12 11:44:42 +01:00
nf_conntrack_proto_generic.c	…
nf_conntrack_proto_gre.c	…
nf_conntrack_proto_icmp.c	…
nf_conntrack_proto_icmpv6.c	…
nf_conntrack_proto_sctp.c	netfilter: ctnetlink: add timeout and protoinfo to destroy events	2020-12-12 11:44:42 +01:00
nf_conntrack_proto_tcp.c	netfilter: ctnetlink: add timeout and protoinfo to destroy events	2020-12-12 11:44:42 +01:00
nf_conntrack_proto_udp.c	netfilter: conntrack: do not auto-delete clash entries on reply	2020-08-29 13:03:06 +02:00
nf_conntrack_sane.c	…
nf_conntrack_seqadj.c	…
nf_conntrack_sip.c	…
nf_conntrack_snmp.c	…
nf_conntrack_standalone.c	netfilter: conntrack: fix reading nf_conntrack_buckets	2021-01-10 09:39:22 +01:00
nf_conntrack_tftp.c	…
nf_conntrack_timeout.c	…
nf_conntrack_timestamp.c	…
nf_dup_netdev.c	netfilter: nf_fwd_netdev: clear timestamp in forwarding path	2020-10-22 14:49:36 +02:00
nf_flow_table_core.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-02-10 13:30:12 -08:00
nf_flow_table_inet.c	…
nf_flow_table_ip.c	netfilter: flowtable: reduce calls to pskb_may_pull()	2020-10-12 01:58:10 +02:00
nf_flow_table_offload.c	…
nf_internals.h	…
nf_log.c	…
nf_log_common.c	netfilter: nf_log: missing vlan offload tag and proto	2020-10-14 01:25:14 +02:00
nf_log_netdev.c	…
nf_nat_amanda.c	…
nf_nat_core.c	netfilter: nf_nat: Fix memleak in nf_nat_init	2021-01-11 00:34:11 +01:00
nf_nat_ftp.c	…
nf_nat_helper.c	…
nf_nat_irc.c	…
nf_nat_masquerade.c	…
nf_nat_proto.c	netfilter: use actual socket sk rather than skb sk when routing harder	2020-10-30 12:57:39 +01:00
nf_nat_redirect.c	…
nf_nat_sip.c	…
nf_nat_tftp.c	…
nf_queue.c	…
nf_sockopt.c	…
nf_synproxy_core.c	selinux/stable-5.11 PR 20201214	2020-12-16 11:01:04 -08:00
nf_tables_api.c	netfilter: nftables: introduce table ownership	2021-02-15 18:17:15 +01:00
nf_tables_core.c	netfilter: nf_tables: Implement fast bitwise expression	2020-10-04 21:08:33 +02:00
nf_tables_offload.c	netfilter: nftables_offload: set address type in control dissector	2020-11-27 12:10:46 +01:00
nf_tables_trace.c	…
nfnetlink.c	netfilter: nf_tables: missing validation from the abort path	2020-10-30 12:57:39 +01:00
nfnetlink_acct.c	netfilter: nfnl_acct: remove data from struct net	2020-12-01 09:45:29 +01:00
nfnetlink_cthelper.c	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
nfnetlink_cttimeout.c	…
nfnetlink_log.c	netfilter: ctnetlink: remove get_ct indirection	2021-01-25 22:06:11 +01:00
nfnetlink_osf.c	…
nfnetlink_queue.c	netfilter: ctnetlink: remove get_ct indirection	2021-01-25 22:06:11 +01:00
nft_bitwise.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_byteorder.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_chain_filter.c	netfilter: nf_tables: add inet ingress support	2020-10-12 01:57:34 +02:00
nft_chain_nat.c	…
nft_chain_route.c	netfilter: use actual socket sk rather than skb sk when routing harder	2020-10-30 12:57:39 +01:00
nft_cmp.c	netfilter: nftables: remove redundant assignment of variable err	2021-02-06 02:43:07 +01:00
nft_compat.c	netfilter: nft_compat: remove flush counter optimization	2020-08-10 13:03:36 +02:00
nft_connlimit.c	…
nft_counter.c	…
nft_ct.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_dup_netdev.c	netfilter: nftables: add nft_parse_register_load() and use it	2021-01-27 22:53:29 +01:00
nft_dynset.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2021-02-06 15:34:23 -08:00
nft_exthdr.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_fib.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_fib_inet.c	…
nft_fib_netdev.c	…
nft_flow_offload.c	netfilter: conntrack: do not auto-delete clash entries on reply	2020-08-29 13:03:06 +02:00
nft_fwd_netdev.c	netfilter: nftables: add nft_parse_register_load() and use it	2021-01-27 22:53:29 +01:00
nft_hash.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_immediate.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_limit.c	…
nft_log.c	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
nft_lookup.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_masq.c	netfilter: nftables: add nft_parse_register_load() and use it	2021-01-27 22:53:29 +01:00
nft_meta.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_nat.c	netfilter: nftables: add nft_parse_register_load() and use it	2021-01-27 22:53:29 +01:00
nft_numgen.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_objref.c	netfilter: nftables: add nft_parse_register_load() and use it	2021-01-27 22:53:29 +01:00
nft_osf.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_payload.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_queue.c	netfilter: nftables: add nft_parse_register_load() and use it	2021-01-27 22:53:29 +01:00
nft_quota.c	…
nft_range.c	netfilter: nftables: add nft_parse_register_load() and use it	2021-01-27 22:53:29 +01:00
nft_redir.c	netfilter: nftables: add nft_parse_register_load() and use it	2021-01-27 22:53:29 +01:00
nft_reject.c	netfilter: nft_reject: unify reject init and dump into nft_reject	2020-10-31 10:40:42 +01:00
nft_reject_inet.c	netfilter: use actual socket sk for REJECT action	2020-12-01 14:33:55 +01:00
nft_reject_netdev.c	netfilter: nft_reject: add reject verdict support for netdev	2020-10-31 10:41:00 +01:00
nft_rt.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_set_bitmap.c	…
nft_set_hash.c	netfilter: nftables: generalize set extension to support for several expressions	2020-12-12 19:20:24 +01:00
nft_set_pipapo.c	…
nft_set_pipapo.h	…
nft_set_pipapo_avx2.c	…
nft_set_pipapo_avx2.h	…
nft_set_rbtree.c	netfilter: nft_set_rbtree: Detect partial overlap with start endpoint match	2020-08-21 17:37:36 +02:00
nft_socket.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_synproxy.c	…
nft_tproxy.c	netfilter: nftables: add nft_parse_register_load() and use it	2021-01-27 22:53:29 +01:00
nft_tunnel.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
nft_xfrm.c	netfilter: nftables: add nft_parse_register_store() and use it	2021-01-27 23:16:02 +01:00
utils.c	netfilter: use actual socket sk rather than skb sk when routing harder	2020-10-30 12:57:39 +01:00
x_tables.c	netfilter: x_tables: Switch synchronization to RCU	2020-12-08 12:57:39 +01:00
xt_AUDIT.c	…
xt_CHECKSUM.c	…
xt_CLASSIFY.c	…
xt_CONNSECMARK.c	…
xt_CT.c	…
xt_DSCP.c	…
xt_HL.c	…
xt_HMARK.c	netfilter: xt_HMARK: Use ip_is_fragment() helper	2020-08-28 19:55:51 +02:00
xt_IDLETIMER.c	…
xt_LED.c	…
xt_LOG.c	…
xt_MASQUERADE.c	…
xt_NETMAP.c	…
xt_NFLOG.c	…
xt_NFQUEUE.c	…
xt_RATEEST.c	netfilter: xt_RATEEST: reject non-null terminated string from userspace	2020-12-27 11:52:26 +01:00
xt_REDIRECT.c	…
xt_SECMARK.c	…
xt_TCPMSS.c	…
xt_TCPOPTSTRIP.c	…
xt_TEE.c	…
xt_TPROXY.c	…
xt_TRACE.c	…
xt_addrtype.c	…
xt_bpf.c	…
xt_cgroup.c	…
xt_cluster.c	…
xt_comment.c	…
xt_connbytes.c	…
xt_connlabel.c	…
xt_connlimit.c	…
xt_connmark.c	…
xt_conntrack.c	…
xt_cpu.c	…
xt_dccp.c	…
xt_devgroup.c	…
xt_dscp.c	…
xt_ecn.c	…
xt_esp.c	…
xt_hashlimit.c	…
xt_helper.c	…
xt_hl.c	…
xt_ipcomp.c	…
xt_iprange.c	…
xt_ipvs.c	…
xt_l2tp.c	…
xt_length.c	…
xt_limit.c	…
xt_mac.c	…
xt_mark.c	…
xt_multiport.c	…
xt_nat.c	…
xt_nfacct.c	netfilter: Remove unnecessary conversion to bool	2020-12-01 09:45:29 +01:00
xt_osf.c	…
xt_owner.c	…
xt_physdev.c	…
xt_pkttype.c	…
xt_policy.c	…
xt_quota.c	…
xt_rateest.c	…
xt_realm.c	…
xt_recent.c	netfilter: xt_recent: Fix attempt to update deleted entry	2021-02-04 00:33:08 +01:00
xt_repldata.h	…
xt_sctp.c	…
xt_set.c	…
xt_socket.c	…
xt_state.c	…
xt_statistic.c	…
xt_string.c	…
xt_tcpmss.c	…
xt_tcpudp.c	…
xt_time.c	…
xt_u32.c	…