conntrack-tools.git/src/nfct-extensions, branch upstream

nfct: Update syntax to specify command before subsystem

2015-08-26T18:43:55+00:00

This patch gets the nfct syntax in sync with nft so it looks like this: nfct object ... instead of: nfct object ... This patch retains backward compatibility so you can still use the old syntax. The manpage and tests have been also updated to promote the adoption of this syntax. We should have little existing clients of this tool as we can only use this to configure the cttimeout and cthelper infrastructures. Signed-off-by: Pablo Neira Ayuso

nfct: timeout: add support for default protocol timeout tuning

2014-05-13T13:53:28+00:00

This new interface supersedes the /proc interface: /proc/sys/net/netfilter/nf_conntrack_PROTO_STATE_timeout to tune default conntrack timeout helpers. # nfct timeout default-get inet tcp .l3proto = 2, .l4proto = 6, .policy = { .SYN_SENT = 120, .SYN_RECV = 60, .ESTABLISHED = 432000, .FIN_WAIT = 120, .CLOSE_WAIT = 60, .LAST_ACK = 30, .TIME_WAIT = 120, .CLOSE = 10, .SYN_SENT2 = 120, .RETRANS = 300, .UNACKNOWLEDGED = 300, }, }; # nfct timeout default-set inet tcp ESTABLISHED 100 As replacement for the existing /proc interfaces for timeout tweaking. This feature requires a Linux kernel >= 3.13. Signed-off-by: Pablo Neira Ayuso

nfct: Fix use-after-free / double-free

2013-10-11T20:43:55+00:00

helper's list and flush commands handlers shouldn't call mnl_socket_close on the passed netlink socket as it is done in the main function after parse_params call. Bug introduced in (3c78a45 nfct: src: consolidate netlink socket creation). Signed-off-by: Hani Benhabiles Signed-off-by: Pablo Neira Ayuso

nfct: src: consolidate netlink socket creation

2013-10-01T11:23:39+00:00

Open the socket from the main function, then pass it as parameter to the corresponding interpreter. Signed-off-by: Pablo Neira Ayuso

nfct: src: add nfct_mnl_talk and use it

2013-10-01T11:22:41+00:00

Add helper function nfct_mnl_talk and use it. Signed-off-by: Pablo Neira Ayuso

nfct: timeout: split nfct_cmd_timeout_add in several functions

2013-09-30T16:22:15+00:00

This patch is a cleanup to split this function in smaller chunks. It is required to prepare default protocol timeout tuning via netlink.

nfct: timeout: use getprotoent

2013-09-30T15:01:04+00:00

The kernel bails out for unsupported protocols. Moreover, we don't need to upgrade to support new protocols. Signed-off-by: Pablo Neira Ayuso

nfct: modularize extensions

2013-09-26T16:52:26+00:00

Modularize timeout and helper extensions. Signed-off-by: Pablo Neira Ayuso

nfct: helper: use CONNTRACKD_LIB_DIR variable set during configuration

2012-08-01T17:38:01+00:00

Instead of hardcoded path to /usr/lib/conntrack-tools/ which might not be true if options like --prefix with different location is passed to conntrack. Signed-off-by: Pablo Neira Ayuso

conntrackd: add cthelper infrastructure (+ example FTP helper)

2012-08-01T17:20:06+00:00

This patch adds the user-space helper infrastructure. It also contains the implementation of the FTP helper in user-space. There's one example file that you can use to configure conntrackd as user-space connection tracking helper under: doc/helper/conntrackd.conf Signed-off-by: Pablo Neira Ayuso