summaryrefslogtreecommitdiff
path: root/doc
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2012-05-15 01:51:29 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2012-05-28 12:34:59 +0200
commite96bfcd1b9f79cb3642b365a584359b1672f2ac0 (patch)
tree48b625978164f802fd1a99bdf49a2e7140f6dc5d /doc
parente47233151ca5098b268281329b119a398918d75f (diff)
downloadconntrack-tools-e96bfcd1b9f79cb3642b365a584359b1672f2ac0.tar.gz
conntrack-tools-e96bfcd1b9f79cb3642b365a584359b1672f2ac0.zip
conntrackd: add cthelper infrastructure (+ example FTP helper)
This patch adds the user-space helper infrastructure. It also contains the implementation of the FTP helper in user-space. There's one example file that you can use to configure conntrackd as user-space connection tracking helper under: doc/helper/conntrackd.conf Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'doc')
-rw-r--r--doc/helper/conntrackd.conf82
1 files changed, 82 insertions, 0 deletions
diff --git a/doc/helper/conntrackd.conf b/doc/helper/conntrackd.conf
new file mode 100644
index 0000000..711b309
--- /dev/null
+++ b/doc/helper/conntrackd.conf
@@ -0,0 +1,82 @@
+#
+# Helper settings
+#
+
+Helper {
+ # Before this, you have to make sure you have registered the `ftp'
+ # user-space helper stub via:
+ #
+ # nfct helper add ftp inet tcp
+ #
+ Type ftp inet tcp {
+ #
+ # Set NFQUEUE number you want to use to receive traffic from
+ # the kernel.
+ #
+ QueueNum 0
+ #
+ # Set the Expectation policy for this helper.
+ #
+ Policy ftp {
+ #
+ # Maximum number of simultaneous expectations
+ #
+ ExpectMax 1
+ #
+ # Maximum living time for one expectation (in seconds).
+ #
+ ExpectTimeout 300
+ }
+ }
+}
+
+#
+# General settings
+#
+General {
+ #
+ # Set the nice value of the daemon, this value goes from -20
+ # (most favorable scheduling) to 19 (least favorable). Using a
+ # very low value reduces the chances to lose state-change events.
+ # Default is 0 but this example file sets it to most favourable
+ # scheduling as this is generally a good idea. See man nice(1) for
+ # more information.
+ #
+ Nice -20
+
+ #
+ # Select a different scheduler for the daemon, you can select between
+ # RR and FIFO and the process priority (minimum is 0, maximum is 99).
+ # See man sched_setscheduler(2) for more information. Using a RT
+ # scheduler reduces the chances to overrun the Netlink buffer.
+ #
+ # Scheduler {
+ # Type FIFO
+ # Priority 99
+ # }
+
+ #
+ # Logfile: on (/var/log/conntrackd.log), off, or a filename
+ # Default: off
+ #
+ LogFile on
+
+ #
+ # Syslog: on, off or a facility name (daemon (default) or local0..7)
+ # Default: off
+ #
+ #Syslog on
+
+ #
+ # Lockfile
+ #
+ LockFile /var/lock/conntrack.lock
+
+ #
+ # Unix socket configuration
+ #
+ UNIX {
+ Path /var/run/conntrackd.ctl
+ Backlog 20
+ }
+}