conntrack-tools.git, branch conntrack-tools-0.9.8

conntrackd: bump version to 0.9.8

2008-10-21T18:32:05+00:00

This patch bumps the version to 0.9.8 Signed-off-by: Pablo Neira Ayuso

conntrackd: add missing information on -t to the help

2008-10-21T18:14:10+00:00

This patch adds missing information on -t when conntrackd is invoked with -h. Signed-off-by: Pablo Neira Ayuso

doc: update conntrackd manpage

2008-10-21T18:13:07+00:00

This patch updates the conntrackd manpage some re-writes, missing options and new dependencies. Signed-off-by: Pablo Neira Ayuso

doc: remove example about CacheWriteTrough

2008-10-21T17:53:23+00:00

This patch removes the documentation about the CacheWriteTrhough clause. This feature is scheduled for removal since the asynchronous nature of conntrackd does not allow multi-path routing support. I'm lying, actually there's a chance to support it, but we have to guarantee that the RTT in the message synchronization between the firewall is smaller than the RTT between the peer and the firewalls. Moreover, this option has made more bad than good since people enable it when things don't work. Making the whole troubleshooting more complicated. Signed-off-by: Pablo Neira Ayuso

filter: do not filter in user-space if kernel supports BSF

2008-10-21T17:11:42+00:00

This patch avoids a double filtering in user-space and kernel-space if the kernel support BSF. Since we do not use BSF for dumps and resyncs, we add a new parameter to ignore_conntrack to indicate if we have to perform the filtering in user-space or not. Signed-off-by: Pablo Neira Ayuso

cache: use jhash2 instead of double jhash+jhash_2words

2008-10-21T17:05:02+00:00

Currently, oprofile reports ~17% of sample in the hashing. With this patch, that uses jhash2 instead of a double call to jhash and one to jhash_2words, it goes down to ~11%. Signed-off-by: Pablo Neira Ayuso

filter: fix segfault if the Filter clause is unused

2008-10-21T16:50:51+00:00

This patch fixes a segfault when conntrackd -k is invoked for an instance of conntrackd with no use of the Filter clause. Signed-off-by: Pablo Neira Ayuso

netlink: report when kernel-space event filtering is in use

2008-10-21T16:25:12+00:00

This patch adds a log message to tell that conntrackd are using kernel-space filtering. Signed-off-by: Pablo Neira Ayuso

doc: rise default size of the hashtable in the example file

2008-10-20T14:52:04+00:00

This patch rises the default value of the hashtables in terms of buckets and entries to the default value in nf_conntrack. Signed-off-by: Pablo Neira Ayuso

notrack: fix double receival of resync requests

2008-10-20T12:17:13+00:00

This patch fixes double insertion in the tx_list if we receive two (or more) consecutive resync request in short time. Signed-off-by: Pablo Neira Ayuso