microsoft
/
WSL2-Linux-Kernel
зеркало из https://github.com/microsoft/WSL2-Linux-Kernel.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
WSL2-Linux-Kernel/net/netfilter
История
Pablo Neira Ayuso 6001a930ce netfilter: nftables: introduce table ownership 
A userspace daemon like firewalld might need to monitor for netlink
updates to detect its ruleset removal by the (global) flush ruleset
command to ensure ruleset persistency. This adds extra complexity from
userspace and, for some little time, the firewall policy is not in
place.

This patch adds the NFT_TABLE_F_OWNER flag which allows a userspace
program to own the table that creates in exclusivity.

Tables that are owned...

- can only be updated and removed by the owner, non-owners hit EPERM if
  they try to update it or remove it.
- are destroyed when the owner closes the netlink socket or the process
  is gone (implicit netlink socket closure).
- are skipped by the global flush ruleset command.
- are listed in the global ruleset.

The userspace process that sets on the NFT_TABLE_F_OWNER flag need to
leave open the netlink socket.

A new NFTA_TABLE_OWNER netlink attribute specifies the netlink port ID
to identify the owner from userspace.

This patch also updates error reporting when an unknown table flag is
specified to change it from EINVAL to EOPNOTSUPP given that EINVAL is
usually reserved to report for malformed netlink messages to userspace.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
 		2021-02-15 18:17:15 +01:00
..
ipset netfilter: ipset: fix shift-out-of-bounds in htable_bits() 2020-12-17 19:44:52 +01:00
ipvs Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2021-02-06 15:34:23 -08:00
Kconfig net: remove redundant 'depends on NET' 2021-01-27 17:04:12 -08:00
Makefile netfilter: nft_reject: add reject verdict support for netdev 2020-10-31 10:41:00 +01:00
core.c netfilter: add inet ingress support 2020-10-12 01:57:34 +02:00
nf_conncount.c
…
nf_conntrack_acct.c
…
nf_conntrack_amanda.c
…
nf_conntrack_broadcast.c
…
nf_conntrack_core.c netfilter: conntrack: skip identical origin tuple in same zone only 2021-02-09 00:04:14 +01:00
nf_conntrack_ecache.c
…
nf_conntrack_expect.c
…
nf_conntrack_extend.c
…
nf_conntrack_ftp.c treewide: Remove uninitialized_var() usage 2020-07-16 12:35:15 -07:00
nf_conntrack_h323_asn1.c netfilter: Use fallthrough pseudo-keyword 2020-07-22 01:18:05 +02:00
nf_conntrack_h323_main.c
…
nf_conntrack_h323_types.c
…
nf_conntrack_helper.c
…
nf_conntrack_irc.c
…
nf_conntrack_labels.c
…
nf_conntrack_netbios_ns.c
…
nf_conntrack_netlink.c netfilter: ctnetlink: remove get_ct indirection 2021-01-25 22:06:11 +01:00
nf_conntrack_pptp.c netfilter: delete repeated words 2020-08-28 20:11:38 +02:00
nf_conntrack_proto.c netfilter: conntrack: nf_conncount_init is failing with IPv6 disabled 2020-09-08 13:04:54 +02:00
nf_conntrack_proto_dccp.c netfilter: ctnetlink: add timeout and protoinfo to destroy events 2020-12-12 11:44:42 +01:00
nf_conntrack_proto_generic.c
…
nf_conntrack_proto_gre.c
…
nf_conntrack_proto_icmp.c netfilter: ctnetlink: add kernel side filtering for dump 2020-05-27 22:20:34 +02:00
nf_conntrack_proto_icmpv6.c netfilter: ctnetlink: add kernel side filtering for dump 2020-05-27 22:20:34 +02:00
nf_conntrack_proto_sctp.c netfilter: ctnetlink: add timeout and protoinfo to destroy events 2020-12-12 11:44:42 +01:00
nf_conntrack_proto_tcp.c netfilter: ctnetlink: add timeout and protoinfo to destroy events 2020-12-12 11:44:42 +01:00
nf_conntrack_proto_udp.c netfilter: conntrack: do not auto-delete clash entries on reply 2020-08-29 13:03:06 +02:00
nf_conntrack_sane.c
…
nf_conntrack_seqadj.c
…
nf_conntrack_sip.c
…
nf_conntrack_snmp.c
…
nf_conntrack_standalone.c netfilter: conntrack: fix reading nf_conntrack_buckets 2021-01-10 09:39:22 +01:00
nf_conntrack_tftp.c
…
nf_conntrack_timeout.c
…
nf_conntrack_timestamp.c
…
nf_dup_netdev.c netfilter: nf_fwd_netdev: clear timestamp in forwarding path 2020-10-22 14:49:36 +02:00
nf_flow_table_core.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2021-02-10 13:30:12 -08:00
nf_flow_table_inet.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nf_flow_table_ip.c netfilter: flowtable: reduce calls to pskb_may_pull() 2020-10-12 01:58:10 +02:00
nf_flow_table_offload.c net: sched: Pass qdisc reference in struct flow_block_offload 2020-07-13 17:22:21 -07:00
nf_internals.h netfilter: ctnetlink: add kernel side filtering for dump 2020-05-27 22:20:34 +02:00
nf_log.c sysctl: pass kernel pointers to ->proc_handler 2020-04-27 02:07:40 -04:00
nf_log_common.c netfilter: nf_log: missing vlan offload tag and proto 2020-10-14 01:25:14 +02:00
nf_log_netdev.c
…
nf_nat_amanda.c
…
nf_nat_core.c netfilter: nf_nat: Fix memleak in nf_nat_init 2021-01-11 00:34:11 +01:00
nf_nat_ftp.c
…
nf_nat_helper.c
…
nf_nat_irc.c
…
nf_nat_masquerade.c
…
nf_nat_proto.c netfilter: use actual socket sk rather than skb sk when routing harder 2020-10-30 12:57:39 +01:00
nf_nat_redirect.c
…
nf_nat_sip.c
…
nf_nat_tftp.c
…
nf_queue.c netfilter: nf_queue: prefer nf_queue_entry_free 2020-03-29 16:28:29 +02:00
nf_sockopt.c netfilter: switch nf_setsockopt to sockptr_t 2020-07-24 15:41:54 -07:00
nf_synproxy_core.c selinux/stable-5.11 PR 20201214 2020-12-16 11:01:04 -08:00
nf_tables_api.c netfilter: nftables: introduce table ownership 2021-02-15 18:17:15 +01:00
nf_tables_core.c netfilter: nf_tables: Implement fast bitwise expression 2020-10-04 21:08:33 +02:00
nf_tables_offload.c netfilter: nftables_offload: set address type in control dissector 2020-11-27 12:10:46 +01:00
nf_tables_trace.c
…
nfnetlink.c netfilter: nf_tables: missing validation from the abort path 2020-10-30 12:57:39 +01:00
nfnetlink_acct.c netfilter: nfnl_acct: remove data from struct net 2020-12-01 09:45:29 +01:00
nfnetlink_cthelper.c treewide: rename nla_strlcpy to nla_strscpy. 2020-11-16 08:08:54 -08:00
nfnetlink_cttimeout.c netfilter: Use fallthrough pseudo-keyword 2020-07-22 01:18:05 +02:00
nfnetlink_log.c netfilter: ctnetlink: remove get_ct indirection 2021-01-25 22:06:11 +01:00
nfnetlink_osf.c netfilter: nf_osf: avoid passing pointer to local var 2020-04-29 21:17:57 +02:00
nfnetlink_queue.c netfilter: ctnetlink: remove get_ct indirection 2021-01-25 22:06:11 +01:00
nft_bitwise.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_byteorder.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_chain_filter.c netfilter: nf_tables: add inet ingress support 2020-10-12 01:57:34 +02:00
nft_chain_nat.c
…
nft_chain_route.c netfilter: use actual socket sk rather than skb sk when routing harder 2020-10-30 12:57:39 +01:00
nft_cmp.c netfilter: nftables: remove redundant assignment of variable err 2021-02-06 02:43:07 +01:00
nft_compat.c netfilter: nft_compat: remove flush counter optimization 2020-08-10 13:03:36 +02:00
nft_connlimit.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_counter.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_ct.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_dup_netdev.c netfilter: nftables: add nft_parse_register_load() and use it 2021-01-27 22:53:29 +01:00
nft_dynset.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2021-02-06 15:34:23 -08:00
nft_exthdr.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_fib.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_fib_inet.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_fib_netdev.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_flow_offload.c netfilter: conntrack: do not auto-delete clash entries on reply 2020-08-29 13:03:06 +02:00
nft_fwd_netdev.c netfilter: nftables: add nft_parse_register_load() and use it 2021-01-27 22:53:29 +01:00
nft_hash.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_immediate.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_limit.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_log.c treewide: rename nla_strlcpy to nla_strscpy. 2020-11-16 08:08:54 -08:00
nft_lookup.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_masq.c netfilter: nftables: add nft_parse_register_load() and use it 2021-01-27 22:53:29 +01:00
nft_meta.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_nat.c netfilter: nftables: add nft_parse_register_load() and use it 2021-01-27 22:53:29 +01:00
nft_numgen.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_objref.c netfilter: nftables: add nft_parse_register_load() and use it 2021-01-27 22:53:29 +01:00
nft_osf.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_payload.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_queue.c netfilter: nftables: add nft_parse_register_load() and use it 2021-01-27 22:53:29 +01:00
nft_quota.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_range.c netfilter: nftables: add nft_parse_register_load() and use it 2021-01-27 22:53:29 +01:00
nft_redir.c netfilter: nftables: add nft_parse_register_load() and use it 2021-01-27 22:53:29 +01:00
nft_reject.c netfilter: nft_reject: unify reject init and dump into nft_reject 2020-10-31 10:40:42 +01:00
nft_reject_inet.c netfilter: use actual socket sk for REJECT action 2020-12-01 14:33:55 +01:00
nft_reject_netdev.c netfilter: nft_reject: add reject verdict support for netdev 2020-10-31 10:41:00 +01:00
nft_rt.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_set_bitmap.c netfilter: nf_tables: do not update stateful expressions if lookup is inverted 2020-04-05 23:26:36 +02:00
nft_set_hash.c netfilter: nftables: generalize set extension to support for several expressions 2020-12-12 19:20:24 +01:00
nft_set_pipapo.c netfilter: Replace HTTP links with HTTPS ones 2020-07-29 20:09:18 +02:00
nft_set_pipapo.h nft_set_pipapo: Prepare for single ranged field usage 2020-03-15 15:27:46 +01:00
nft_set_pipapo_avx2.c nft_set_pipapo: Prepare for single ranged field usage 2020-03-15 15:27:46 +01:00
nft_set_pipapo_avx2.h x86: update AS_* macros to binutils >=2.23, supporting ADX and AVX2 2020-04-09 00:12:48 +09:00
nft_set_rbtree.c netfilter: nft_set_rbtree: Detect partial overlap with start endpoint match 2020-08-21 17:37:36 +02:00
nft_socket.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_synproxy.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
nft_tproxy.c netfilter: nftables: add nft_parse_register_load() and use it 2021-01-27 22:53:29 +01:00
nft_tunnel.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_xfrm.c netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
utils.c netfilter: use actual socket sk rather than skb sk when routing harder 2020-10-30 12:57:39 +01:00
x_tables.c netfilter: x_tables: Switch synchronization to RCU 2020-12-08 12:57:39 +01:00
xt_AUDIT.c
…
xt_CHECKSUM.c
…
xt_CLASSIFY.c
…
xt_CONNSECMARK.c netfilter: Replace HTTP links with HTTPS ones 2020-07-29 20:09:18 +02:00
xt_CT.c
…
xt_DSCP.c
…
xt_HL.c
…
xt_HMARK.c netfilter: xt_HMARK: Use ip_is_fragment() helper 2020-08-28 19:55:51 +02:00
xt_IDLETIMER.c netfilter: xt_IDLETIMER: target v1 - match Android layout 2020-04-05 23:26:37 +02:00
xt_LED.c
…
xt_LOG.c
…
xt_MASQUERADE.c
…
xt_NETMAP.c
…
xt_NFLOG.c
…
xt_NFQUEUE.c
…
xt_RATEEST.c netfilter: xt_RATEEST: reject non-null terminated string from userspace 2020-12-27 11:52:26 +01:00
xt_REDIRECT.c
…
xt_SECMARK.c
…
xt_TCPMSS.c
…
xt_TCPOPTSTRIP.c
…
xt_TEE.c
…
xt_TPROXY.c
…
xt_TRACE.c
…
xt_addrtype.c
…
xt_bpf.c
…
xt_cgroup.c
…
xt_cluster.c
…
xt_comment.c
…
xt_connbytes.c
…
xt_connlabel.c
…
xt_connlimit.c
…
xt_connmark.c netfilter: Replace HTTP links with HTTPS ones 2020-07-29 20:09:18 +02:00
xt_conntrack.c
…
xt_cpu.c
…
xt_dccp.c
…
xt_devgroup.c
…
xt_dscp.c
…
xt_ecn.c
…
xt_esp.c
…
xt_hashlimit.c
…
xt_helper.c
…
xt_hl.c
…
xt_ipcomp.c
…
xt_iprange.c
…
xt_ipvs.c
…
xt_l2tp.c
…
xt_length.c
…
xt_limit.c
…
xt_mac.c
…
xt_mark.c
…
xt_multiport.c
…
xt_nat.c netfilter: Add MODULE_DESCRIPTION entries to kernel modules 2020-06-25 00:50:31 +02:00
xt_nfacct.c netfilter: Remove unnecessary conversion to bool 2020-12-01 09:45:29 +01:00
xt_osf.c
…
xt_owner.c
…
xt_physdev.c
…
xt_pkttype.c
…
xt_policy.c
…
xt_quota.c
…
xt_rateest.c
…
xt_realm.c
…
xt_recent.c netfilter: xt_recent: Fix attempt to update deleted entry 2021-02-04 00:33:08 +01:00
xt_repldata.h
…
xt_sctp.c
…
xt_set.c
…
xt_socket.c
…
xt_state.c
…
xt_statistic.c
…
xt_string.c
…
xt_tcpmss.c
…
xt_tcpudp.c
…
xt_time.c netfilter: Replace HTTP links with HTTPS ones 2020-07-29 20:09:18 +02:00
xt_u32.c
…