Pablo Neira Ayuso b4e70d8dd9 netfilter: nftables: add set expression flags ... The set flag NFT_SET_EXPR provides a hint to the kernel that userspace supports for multiple expressions per set element. In the same direction, NFT_DYNSET_F_EXPR specifies that dynset expression defines multiple expressions per set element. This allows new userspace software with old kernels to bail out with EOPNOTSUPP. This update is similar to ef516e8625 ("netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag"). The NFT_SET_EXPR flag needs to be set on when the NFTA_SET_EXPRESSIONS attribute is specified. The NFT_SET_EXPR flag is not set on with NFTA_SET_EXPR to retain backward compatibility in old userspace binaries. Fixes: 48b0ae046e ("netfilter: nftables: netlink support for several set element expressions") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2020-12-28 10:50:26 +01:00
..
ipset	netfilter: ipset: fix shift-out-of-bounds in htable_bits()	2020-12-17 19:44:52 +01:00
ipvs	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2020-12-14 15:43:21 -08:00
core.c	netfilter: add inet ingress support	2020-10-12 01:57:34 +02:00
Kconfig	netfilter: nft_reject: add reject verdict support for netdev	2020-10-31 10:41:00 +01:00
Makefile	netfilter: nft_reject: add reject verdict support for netdev	2020-10-31 10:41:00 +01:00
nf_conncount.c
nf_conntrack_acct.c
nf_conntrack_amanda.c
nf_conntrack_broadcast.c
nf_conntrack_core.c
nf_conntrack_ecache.c
nf_conntrack_expect.c
nf_conntrack_extend.c
nf_conntrack_ftp.c
nf_conntrack_h323_asn1.c
nf_conntrack_h323_main.c
nf_conntrack_h323_types.c
nf_conntrack_helper.c
nf_conntrack_irc.c
nf_conntrack_labels.c
nf_conntrack_netbios_ns.c
nf_conntrack_netlink.c	netfilter: ctnetlink: add timeout and protoinfo to destroy events	2020-12-12 11:44:42 +01:00
nf_conntrack_pptp.c
nf_conntrack_proto_dccp.c	netfilter: ctnetlink: add timeout and protoinfo to destroy events	2020-12-12 11:44:42 +01:00
nf_conntrack_proto_generic.c
nf_conntrack_proto_gre.c
nf_conntrack_proto_icmp.c
nf_conntrack_proto_icmpv6.c
nf_conntrack_proto_sctp.c	netfilter: ctnetlink: add timeout and protoinfo to destroy events	2020-12-12 11:44:42 +01:00
nf_conntrack_proto_tcp.c	netfilter: ctnetlink: add timeout and protoinfo to destroy events	2020-12-12 11:44:42 +01:00
nf_conntrack_proto_udp.c	netfilter: conntrack: do not auto-delete clash entries on reply	2020-08-29 13:03:06 +02:00
nf_conntrack_proto.c	netfilter: conntrack: nf_conncount_init is failing with IPv6 disabled	2020-09-08 13:04:54 +02:00
nf_conntrack_sane.c
nf_conntrack_seqadj.c
nf_conntrack_sip.c
nf_conntrack_snmp.c
nf_conntrack_standalone.c	netfilter: conntrack: proc: rename stat column	2020-09-22 01:33:35 +02:00
nf_conntrack_tftp.c
nf_conntrack_timeout.c
nf_conntrack_timestamp.c
nf_dup_netdev.c	netfilter: nf_fwd_netdev: clear timestamp in forwarding path	2020-10-22 14:49:36 +02:00
nf_flow_table_core.c	netfilter: flowtable: reduce calls to pskb_may_pull()	2020-10-12 01:58:10 +02:00
nf_flow_table_inet.c
nf_flow_table_ip.c	netfilter: flowtable: reduce calls to pskb_may_pull()	2020-10-12 01:58:10 +02:00
nf_flow_table_offload.c
nf_internals.h
nf_log_common.c	netfilter: nf_log: missing vlan offload tag and proto	2020-10-14 01:25:14 +02:00
nf_log_netdev.c
nf_log.c
nf_nat_amanda.c
nf_nat_core.c
nf_nat_ftp.c
nf_nat_helper.c
nf_nat_irc.c
nf_nat_masquerade.c
nf_nat_proto.c	netfilter: use actual socket sk rather than skb sk when routing harder	2020-10-30 12:57:39 +01:00
nf_nat_redirect.c
nf_nat_sip.c
nf_nat_tftp.c
nf_queue.c
nf_sockopt.c
nf_synproxy_core.c	selinux/stable-5.11 PR 20201214	2020-12-16 11:01:04 -08:00
nf_tables_api.c	netfilter: nftables: add set expression flags	2020-12-28 10:50:26 +01:00
nf_tables_core.c	netfilter: nf_tables: Implement fast bitwise expression	2020-10-04 21:08:33 +02:00
nf_tables_offload.c	netfilter: nftables_offload: set address type in control dissector	2020-11-27 12:10:46 +01:00
nf_tables_trace.c
nfnetlink_acct.c	netfilter: nfnl_acct: remove data from struct net	2020-12-01 09:45:29 +01:00
nfnetlink_cthelper.c	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
nfnetlink_cttimeout.c
nfnetlink_log.c
nfnetlink_osf.c
nfnetlink_queue.c
nfnetlink.c	netfilter: nf_tables: missing validation from the abort path	2020-10-30 12:57:39 +01:00
nft_bitwise.c	netfilter: nf_tables: Implement fast bitwise expression	2020-10-04 21:08:33 +02:00
nft_byteorder.c
nft_chain_filter.c	netfilter: nf_tables: add inet ingress support	2020-10-12 01:57:34 +02:00
nft_chain_nat.c
nft_chain_route.c	netfilter: use actual socket sk rather than skb sk when routing harder	2020-10-30 12:57:39 +01:00
nft_cmp.c	netfilter: nftables_offload: build mask based from the matching bytes	2020-11-27 12:10:47 +01:00
nft_compat.c
nft_connlimit.c
nft_counter.c
nft_ct.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-12-11 22:29:38 -08:00
nft_dup_netdev.c
nft_dynset.c	netfilter: nftables: add set expression flags	2020-12-28 10:50:26 +01:00
nft_exthdr.c
nft_fib_inet.c
nft_fib_netdev.c
nft_fib.c
nft_flow_offload.c	netfilter: conntrack: do not auto-delete clash entries on reply	2020-08-29 13:03:06 +02:00
nft_fwd_netdev.c	netfilter: nf_fwd_netdev: clear timestamp in forwarding path	2020-10-22 14:49:36 +02:00
nft_hash.c
nft_immediate.c
nft_limit.c
nft_log.c	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
nft_lookup.c
nft_masq.c
nft_meta.c	netfilter: nftables_offload: build mask based from the matching bytes	2020-11-27 12:10:47 +01:00
nft_nat.c
nft_numgen.c
nft_objref.c
nft_osf.c
nft_payload.c	netfilter: nftables_offload: build mask based from the matching bytes	2020-11-27 12:10:47 +01:00
nft_queue.c
nft_quota.c
nft_range.c
nft_redir.c
nft_reject_inet.c	netfilter: use actual socket sk for REJECT action	2020-12-01 14:33:55 +01:00
nft_reject_netdev.c	netfilter: nft_reject: add reject verdict support for netdev	2020-10-31 10:41:00 +01:00
nft_reject.c	netfilter: nft_reject: unify reject init and dump into nft_reject	2020-10-31 10:40:42 +01:00
nft_rt.c
nft_set_bitmap.c
nft_set_hash.c	netfilter: nftables: generalize set extension to support for several expressions	2020-12-12 19:20:24 +01:00
nft_set_pipapo_avx2.c
nft_set_pipapo_avx2.h
nft_set_pipapo.c
nft_set_pipapo.h
nft_set_rbtree.c
nft_socket.c	netfilter: nft_socket: add wildcard support	2020-08-29 13:04:44 +02:00
nft_synproxy.c
nft_tproxy.c
nft_tunnel.c
nft_xfrm.c
utils.c	netfilter: use actual socket sk rather than skb sk when routing harder	2020-10-30 12:57:39 +01:00
x_tables.c	netfilter: x_tables: Switch synchronization to RCU	2020-12-08 12:57:39 +01:00
xt_addrtype.c
xt_AUDIT.c
xt_bpf.c
xt_cgroup.c
xt_CHECKSUM.c
xt_CLASSIFY.c
xt_cluster.c
xt_comment.c
xt_connbytes.c
xt_connlabel.c
xt_connlimit.c
xt_connmark.c
xt_CONNSECMARK.c
xt_conntrack.c
xt_cpu.c
xt_CT.c
xt_dccp.c
xt_devgroup.c
xt_dscp.c
xt_DSCP.c
xt_ecn.c
xt_esp.c
xt_hashlimit.c
xt_helper.c
xt_hl.c
xt_HL.c
xt_HMARK.c
xt_IDLETIMER.c
xt_ipcomp.c
xt_iprange.c
xt_ipvs.c
xt_l2tp.c
xt_LED.c
xt_length.c
xt_limit.c
xt_LOG.c
xt_mac.c
xt_mark.c
xt_MASQUERADE.c
xt_multiport.c
xt_nat.c
xt_NETMAP.c
xt_nfacct.c	netfilter: Remove unnecessary conversion to bool	2020-12-01 09:45:29 +01:00
xt_NFLOG.c
xt_NFQUEUE.c
xt_osf.c
xt_owner.c
xt_physdev.c
xt_pkttype.c
xt_policy.c
xt_quota.c
xt_rateest.c
xt_RATEEST.c	netfilter: xt_RATEEST: reject non-null terminated string from userspace	2020-12-27 11:52:26 +01:00
xt_realm.c
xt_recent.c
xt_REDIRECT.c
xt_repldata.h
xt_sctp.c
xt_SECMARK.c
xt_set.c
xt_socket.c
xt_state.c
xt_statistic.c
xt_string.c
xt_tcpmss.c
xt_TCPMSS.c
xt_TCPOPTSTRIP.c
xt_tcpudp.c
xt_TEE.c
xt_time.c
xt_TPROXY.c
xt_TRACE.c
xt_u32.c