conntrack-tools.git, branch conntrack-tools-0.9.10

configure: bump version to 0.9.10

2009-01-25T20:00:03+00:00

Signed-off-by: Pablo Neira Ayuso

doc: increase hashtable bucket size and limits in example files

2009-01-25T18:15:01+00:00

This patch details a bit more the hashtable parameters. Moreover, it increases the default size of the hashtable. Signed-off-by: Pablo Neira Ayuso

doc: use 'From' instead of 'from' in the example configfiles

2009-01-25T17:50:43+00:00

This patch fixes a wrong use of 'from' instead of 'From' in the example configuration files. Reported-by: Yoann Juet Signed-off-by: Pablo Neira Ayuso

doc: unset CommitTimeout by default

2009-01-25T17:21:26+00:00

This patch disables CommitTimeout by default. The daemon now uses the approximate timeout calculation by default. Signed-off-by: Pablo Neira Ayuso

netlink: set IP_CT_TCP_FLAG_CLOSE_INIT for TIME_WAIT states

2009-01-25T16:53:21+00:00

This patch sets IP_CT_TCP_FLAG_CLOSE_INIT if the entry is in TCP TIME_WAIT state. This patch is a workaround, the daemon should propagate the internal TCP flags to make it fully independent of possible changes in the TCP tracking code. Signed-off-by: Pablo Neira Ayuso

src: increase default PurgeTimeout value

2009-01-25T16:53:14+00:00

This patch increases the default PurgeTimeout value to 60 seconds. The former 15 seconds provides good real-time reaction in terms of user-side expected behaviour, but it is too small if you trigger random failure in a firewall cluster. Signed-off-by: Pablo Neira Ayuso

src: add support for approximate timeout calculation during commit

2009-01-25T16:53:05+00:00

During the commit phase, the entries in the external cache entries are inserted in the kernel conntrack table. Currently, we use a fixed timeout that is specified in the config file. With this patch, if you don't specify the fixed timeout value via CommitTimeout, the daemon calculates the real timeout value during the commit phase. Signed-off-by: Pablo Neira Ayuso

cache: move lifetime feature to main cache code

2009-01-25T16:53:02+00:00

The lifetime feature is used by all working modes, it is useful to know how long it has been an entry living in the cache. This patch moves the lifetime feature to the main caching code. Signed-off-by: Pablo Neira Ayuso

src: change behaviour of `-t' option

2009-01-25T16:52:56+00:00

With this patch, the `-t' option adds an alarm that will flush the cache after CONFIG(purge_timeout) seconds specified in the config file. This looks much cleaner and more performance that looping on the entire conntrack table to set the new timeout of every single entry. Signed-off-by: Pablo Neira Ayuso

src: don't clone when calling nl_*_conntrack functions

2009-01-25T16:51:23+00:00

This patch removes the clone conntrack objects created before calling nl_*_conntrack functions since they are not required anymore (the previous patch guarantees that objects passed as parameter are not modified). Signed-off-by: Pablo Neira Ayuso