diff options
| -rw-r--r-- | debian/changelog | 903 |
1 files changed, 903 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog index 05ad082..f7b4c0c 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,906 @@ +conntrack (0.9.14-2+vyatta15) unstable; urgency=low + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org ] + * add pablo's conntrack tool + * - add support for new list-conntrack-and-zero-counters flag (-z) + * add GPL + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org ] + * Major resync + * o Created changelog file + * Kill hardcoded CONNTRACK_LIB_DIR=/usr/local/lib, now it uses $prefix + value + * Simplify event_handler + * Completed some stuff related to protocol helpers: + * o Added descriptive error messages. + * Fix wrong handler number in expectation dumping + * Added missing libct_proto_icmp file + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org ] + * o Fixed syntax error (tab/space issue) in help message + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org ] + * o Use conntrack netlink attributes: Major change + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org ] + * major re-sync with current names/definitions in libctnetlink and + kernel + * libctnetlink now called libnfnetlink_conntrack + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org ] + * More re-sync to work fine with current ip_conntrack_netlink + implementation + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org ] + * use new header file + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org ] + * Resync to current libnfnetlink_conntrack and 2.6.14 tree + * Resync to 2.6.14 and libnfnetlink_conntrack + * Bumped version to 0.80 + * kill TODO file + * o Fix packet and bytes counters (use __be64_to_cpu) + * Fix ip_conntrack_netlink load-on-demand + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org ] + * make sure we build against KERELDIR! + * get rid of old "-A" stuff + * get rid of c++ style comments + * major update (See ChangeLog) + * fix "dist-bzip2" for firt reelase + * make sure manpage is included in dist + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org ] + * o Fix up counters + * See Changelog + * See ChangeLog + * See ChangeLog + * See ChangeLog + * See ChangeLog + * See ChangeLog + * See ChangeLog + * See ChangeLog + * See ChangeLog + * See ChangeLog + * See ChangeLog. This fixes an indentation problem in conntrack.c, + I've separated + * See ChangeLog + * See ChangeLog + * o Add --id to the conntrack manpage + * o Fix --id parameter parsing + * See ChangeLog + * See ChangeLog + * See ChangeLog + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org ] + * add extra argument to nfct_register_callback() to accomodate change + in libnetfilter_conntrack + * update changelog + * we don't use libnfnetlink directly, so we don't link it explicitly + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org ] + * See ChangeLog + * See ChangeLog + * See ChangeLog + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org ] + * - rename plugisn to remove 'lib' prefix + * don't use library versioning for extensions + * we don't use libnfnetlink directly, so there is no need for having + configure script checking for it + * - don't install the header files when 'make install' is run. they're + private + * update changelog to reflect recent changes + * - get rid of KERNELDIR + * use AM_CFLAGS, not CFLAGS + * update revision to 0.99 + * linke with libnetfilter_conntrack + * some libc's don't have IPPROTO_SCTP yet + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org ] + * Fixed oversized number of options (Marcus Sundberg) + * o Add support to filter events. ie: -p tcp --orig-port-dst 80 in + * o Restore include "conntrack.h" in ICMP handler + * We only support ipv4 at the moment, set l3protonum to AF_INET + * More changes to prepare upcoming ipv4 support + * <pablo@netfilter.org> + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org ] + * add debian package support (Max Kellermann) + * use '1.00' instead of '1.0' as version number + * make 'rules' executable, remove 'tarball' from cdbs + * add 'debian' to EXTRA_DIST + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org ] + * o Added missing parameters to set the ports of an expectation tuple + * o Add support to filter dumped entries. ie: + * fix ICMP protocol extension parse callback + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org ] + * [PATCH] conntrack: Fix option parsing for ARM (Philip Craig + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=kaber/emailAddress=kaber@netfilter.org ] + * [PATCH] fix conntrack compilation (Eric Leblond <eric@inl.fr>) + * [PATCH]: Userspace code related to fixed timeout patch (Eric Leblond + <eric@inl.fr>) + * [PATCH 5/6] conntrack pkt-config changes (KOVACS Krisztian + <hidden@balabit.hu>) + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org ] + * comment `autoheader' invocation from autogen.sh, we don't need any + config.h file to compile the conntrack tool + + [ /C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=kaber/emailAddress=kaber@netfilter.org ] + * [patch] conntrack compile fix (Thomas Jarosch + <thomas.jarosch@intra2net.com>) + * [patch] conntrack tool: Fix loading of protocol helpers (Thomas + Jarosch <thomas.jarosch@intra2net.com>) + + [ /C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org ] + * initial import of the conntrack daemon to Netfilter SVN + * first step forward to merge conntrackd and conntrack into the same + building chain + * del initial daemon and cli directories + * - Merge conntrack and conntrackd changelogs, even if it will be + dropped from SVN soon. + * introduce conntrack(8) manpage + * - bump version to 0.9.3 + * - remove overkill recursive Makefile.am definition in examples/ (use + EXTRA_DIST) + * move test.sh into examples/ + * fix MODULE_DIR enviroment variable + * - add warning note to ctnl_test.c: old API is deprecated + * - update changelog + * o introduce '--output xml,extended,timestamp' option for '-L', '-G' + and '-E' + * add script for keepalived fault state (eg. unplugged cable/link + down) + * - remove dead code sync-mode.c + * - introduce cache_iterate + * add missing ignore_conntrack in the overrun handler + * - update TODO list + * simplify checksum code: use UDP/multicast checksum facilities + * conntrack --output requires one parameter (Krzysztof Oledzki) + * fix silly bug in build_network_message: out of bound memset + * fix error message in configure.in (Eric Leblond) + * o remove useless backlog parameter in multicast sockets + * o use NFCT_SOPT_SETUP_* facilities: nfct_setobjopt + * add aliases --sport and --dport to make it more iptables-like + * commit phase: if conntrack exists, update it + * - add support for `-L --src-nat' and `-L --dst-nat' to show natted + connections + * add library dependency checking + * remove dlopen infrastructure: simplification, it was too much for it + * - local requests return EXIT_FAILURE if it can't connect to the + daemon + * - more cleanups and code refactorization + * fork when internal/external dump and commit requests are received + * fix dyslexia bug in Changelog (Pablo... we live in 2007, not in + 2006) and + * do not include .svn directories in tarballs + * - conntrack-tools requires libnetfilter_conntrack >= 0.0.81 + * conntrackd: + * include protocol filter parameters in the manpage + * minor fix in the last commit: check conf->mtu instead of mtu that is + < 0 + * - simplify cache_flush function: use cache_del() + * fix NAT in changes committed in r6904 + * prepare 0.9.5 release + * remove script_fault.sh script + * conntrackd requires the connection tracking event API: insist more + in INSTALL + * conntrack-tools compilation problem (K.Kovacs) + * improve INSTALL file + * Remove window tracking disabling limitation (requires Linux kernel + >= 2.6.22) + * bump libnetfilter_conntrack version dependency + * add syslog support and bump version + * Add CacheWriteThrough clause: external cache write through policy. + This feature is particularly useful for active-active setup without + connection persistency, ie. you cannot know which firewall would + filter a packet that belongs to a connection. + * = conntrack = + * raise ignorepoll limit from 1024 to INT_MAX + * o Use more appropriate names for the existing synchronization modes: + * fix minor typo in warning message + + [ Ayuso/emailAddress=pablo@netfilter.org ] + * rename `examples' directory to `doc' + * o add support for related conntracks (requires Linux kernel >= + 2.6.22) + + [ /C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org ] + * show error and warning messages to stderr + * - hash lookup speedups based on comments from netdev's discussions + * o add support for connection logging to the statistics mode via + Logfile + * add more descriptive information to the conntrackd.conf example file + for the stats mode + * update TODO file: logging for the statistics has been implemented + * Ben Lentz <BLentz@channing-bete.com>: + * Ben Lentz <BLentz@channing-bete.com>: + * obsolete `-S' option: Use information provided by the config file + * update conntrackd(8) manpage last update reference + * daemonize conntrackd after initialization + * rename class `buffer' to `queue' which is what it really implements + * implement buffered connection logging to improve performance + * fix logfiles permissions, do not default to umask + * fix make distcheck + * fix segfaul in the exit path for the statistics mode (introduced in + r7175) + * wake up the daemon iff there are real events to handle instead of + polling (Based on comments from Max Kellerman) + * fix statistics mode CPU sucks up (broken with 7178) + * fix buffer flush before exiting + * add support for tagged vlan interfaces in the config file, e.g. + eth0.1 + * o remove -lpthread during compilation + * add support for `conntrack -E -o xml,timestamp' + * set up the configuration flags when defaulting + * improve alarm framework based on suggestions from Max Duempel + * make sure add_alarm() and mod_alarm() insert sorted by due time + * fix overflow in usecs in mod_alarm() + * fix broken next alarm calculation in the run loop + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org> + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * constify queue_iterate() + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Add include/netlink.h and include/traffic_stats.h + * add traffic_stats.h and netlink.h to include/Makefile.am + * merge several *_alarm() functions into init_alarm() + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * minor constification fixes + * use list_del_init() and list_empty() to check if a node is in the + list + * more list_empty() use instead of directly check the header + * Max Kellermann <max@duempel.org>: + * fix missing bracket + * remove unrequired list_del_init in alarm.c + * remove unix socket file on exit + * use umask() to set up file permissions + * fix missing command initialization (breakage introduced in r7208) + * Max Kellermann <max@duempel.org>: + * enable C99 mode + * Max Kellermann <max@duempel.org>: + * Max Kellerman <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Fix wrong dlog call + * yet another rework of the alarm scheduler + * Based on patch from Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * remove alarm counter + * minor cleanups + * fix inconsistent alarm update in cache_alarm_update + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * add comment to clarify handle_msg() + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * missing casting to keep -Werror happy + * Max Kellermann <max@duempel.org>: + * Max Kellermann <max@duempel.org>: + * remain is size_t instead of ssize_t to remove the cast + * implement a rb-tree based alarm framework + * add IPv6 support to conntrackd + * remove leftover line referring old -S option + * o add IPv6 information to synchronization messages + * add missing bits for NAT sequence adjusment support + * From: Max Kellermann <max@duempel.org> + * From: Max Kellermann <max@duempel.org> + * From: Max Kellermann <max@duempel.org> + * From: Max Kellermann <max@duempel.org> + * From: Max Kellermann <max@duempel.org> + * compose the file descriptor set at initialization stage to save some + cycles + * cleanup: remove config_set from main(), use config_file variable + instead + * relicense conntrack-tools as GPLv3+, so far the most significant + contributor has been Max Kellermann and has no issues with + relicensing their contributions. + * revert relicensing... still we use linux_list.h code which seems to + be GPLv2 only which is incompatible AFAIK + * update changelog with 0.9.6 release date + * remove .svn from doc/ in tarballs (reported by Gilad Benjamini) + * Pablo Neira Ayuso <pablo@netfilter.org>: + * Krzysztof Oledzki <ole@ans.pl>: + * add missing libct_proto_icmpv6.c + * fix minor compilation issue in amd64 with gcc4.3 (reported by Daniel + Schepler + * fix compilation in ARM (reported by Thiemo Seufer via Max + Kellermann) + * fix asymmetric path support (still some open concerns) + * improve netlink overrun handling + * update manpages with the new URL + * o simplify parameter-handling code + * This is a major improvement of the conntrack command line tool: + * add initial automated qa testing for the conntrack cli + * check for pkg-config before anything (fix bogus missing libraries + failure) + * relax parameter checking for UDP and TCP + * fix conntrack -U -p tcp [...] + * o fix NAT filtering via --src-nat and --dst-nat (reported by + K.Oledzki) + * minor update of the manpages + * add more verbose error notification when the injection of a + conntrack fails + * rework of the FT-FW approach + * Fix reorder possible reordering of destroy messages under message + omission. This patch introduces the TimeoutDestroy clause to + determine how long a conntrack remains in the internal cache once it + has been destroy from the kernel table. + * minor fix of the manpage (Max Wilhelm) + + [ Pablo Neira Ayuso ] + * - remove (misleading) counters and use information from the + statistics mode + * improve network message sanity checkings + * add Mcast[Snd|Rcv]SocketBuffer clauses to tune multicast socket + buffers + * Updates (-U) show the effect of the operation in the conntrack entry + * check for missing IPv6 address before hashing + * only allow the use of --secmark for listing (filtering) + * add flex version warning (better with >= 2.5.33) + * add eventfd emulation to communicate receiver -> sender + * add best effort replication protocol (aka NOTRACK) + * rework the HELLO logic inside FT-FW + * fix leak in cache_destroy(): release objects before destroying the + cache + * remove secmark support for conntrackd + * fix make distcheck + * define SO_[RCV|SND]BUFFORCE if not set + * increase deletion stats when the timer is scheduled in + cache_del_timeout() + * delay the closure of the dump descriptor to fix assertion with + cache_wt + * check if entries already exist in kernel before injection + + [ Albin Tonerre ] + * fix unsecure usage of printf and include limits.h (PATH_MAX and + INT_MAX) + + [ Pablo Neira Ayuso ] + * do not include Changelog in tarballs, user git shortlog for + changelog instead + * use only the original tuple to check if a conntrack is present + * fix xml output: wrap output with one root element + * Major rework of the user-space event filtering + * add support for kernel-space filtering via BSF + * log: syslog displays the entry that triggers the error + * filter: skip protocol state filtering if state not present + * CLI: add new option --buffer-size for -E + * add more sanity checks in the input path + + [ Eric Leblond ] + * commit: retry at least once if we hit ETIME or ENOMEM + + [ Pablo Neira Ayuso ] + * fix: use %zu instead of %u for size_t + * cleanup: remove obsolete clause Replicate in the example conffiles + * fix: wrong information related to default logging action + * fix: wrong use of timersub in cache_timer + * fix broken normal deletion in caches + * ftfw: show consistent information to users for problem diagnosing + * doc: remove duplicated example files + * script: rework scripts that enable interaction with keepalived + * conntrackd: add -t option to shorten conntrack timeouts + * fix missing updates in the example files + * script: fix broken if branches + * cache_iterators: do not report ENOENT in cache_reset_timers + * script: yet another minor fix + * netlink: add getter and check existence functions + * cache iterators: rework cache_reset_timers + * cache iterators: commit master entries before related ones + * netlink: avoid errors related to the expected bit handling + * cli: remove duplicated optarg checking + * cli: remove unrequired \n in error message + * cli: check for missing arguments in getopt_long + * cli: insert `conntrack-tools' string in help and error messages + * compilation: relax too strict warning checking + * ftfw: check for malformed ack and nack messages + * filter: fix NAT detection tweak + * cleanup: Linux kernel version checking + * filter: check if kernel-space filtering is available + * cleanup: remove some debug messages from sync-ftfw.c + * config: use /var/run to create the UNIX socket file + * fix: remove node from tx_list when the state-entry is destroy + * ftfw: fix race that triggers a double insertion into tx_list + * ftfw: fix race condition in the helloing routine + * ftfw: reset window and flush the resend queue during helloing + * conntrack: cleanup for the update path + * conntrack: cleanup XML header handling + * conntrack: fix mark-based filtering for event display + * conntrack: fix filtering for unsupported protocol + * conntrack: fix dump counter displayed with -L expect + * manual: add initial user manual + * doc: update INSTALL file + * conntrack: cleanup for NAT filtering + * cache: fix update of scheduled-to-timeout entries + * cache-iterators: improve committing + * config: fix usage of 'PurgeTimeout' in Sync NOTRACK + * notrack: fix double receival of resync requests + * doc: rise default size of the hashtable in the example file + * netlink: report when kernel-space event filtering is in use + * filter: fix segfault if the Filter clause is unused + * cache: use jhash2 instead of double jhash+jhash_2words + * filter: do not filter in user-space if kernel supports BSF + * doc: remove example about CacheWriteTrough + * doc: update conntrackd manpage + * conntrackd: add missing information on -t to the help + * conntrackd: bump version to 0.9.8 + * ftfw: rise the size of the acknowledgment window in the example + * conntrack: add missing -U in conntrack(8) manpage + * ftfw: add option `-v' to output debugging information (if any) + * ftfw: remove bottleneck in ack/nack handling + * network: remove message omission test-code + * network: add protocol version field (breaks backward compatibility) + * network: rework TLV-based protocol + * filter: use XOR instead of branches + * filter: use jhash2 instead of jhash for IPv6 addresses + * filter: remove useless branch in the check functions + * conntrack: --status should not be mandatory with -I + * filter: choose the filtering method via configuration file + * conntrack: cleanup command line tool protocol extensions + * build: add attribute header size to total attribute length + * filter: CIDR-based filtering support + * run: release fds structure in the exit path + * fds: remove unused array of file descriptors + * ftfw: remove useless ftfw_run invocation in the alive alarm handler + * src: move callbacks to run.c for better readability + * conntrack: do_parse_parameter show warning to stderr (not to stdout) + * conntrack: remove hardcoded buffer size, use sizeof instead + * conntrack: support diminutives for -L + * conntrack: move release options code to free_options() + * config: move `Checksum' inside `Multicast' clause + * network: make tx buffer initialization independent of mcast config + * manpage: add notice about conntrackd version incompatibilities + * conntrack: add new --status EXPECTED to filter expected connections + * manpage: add --status FIXED_TIMEOUT and EXPECTED + * build: do not include NTA_TIMEOUT in the replication messages + * netlink: clone conntrack object while creation/update + * netlink: use NFCT_Q_[CREATE|UPDATE] instead of NFCT_Q_CREATE_UPDATE + * netlink: constify conntrack object parameter of nl_*_conntrack() + * netlink: remove unnecessary whitespace lines in netlink.h + * netlink: unset ATTR_HELPER_NAME to avoid EBUSY in + nl_update_conntrack() + * parse: fix missing master layer 4 protocol number assignation + * network: remove unused function mcast_send_netmsg() + * network: remove length parameter of mcast_buffered_send_netmsg() + * network: remove __do_send() function + * network: remove the netpld header from the messages + * network: fix data offset alignment returned by NTA_DATA macro + * parse: strict attribute size checking + * src: recover conntrackd -F operation + * run: better wait() error handling + * netlink: fix EILSEQ error messages due to process race condition + * cache_iterators: use a cloned object while resetting timers + * netlink: build TCP flags/mask only if this is a TCP connection + * netlink: conditional build of TCP flags/mask for updates + * netlink: do not build the reply tuple in update messages + * configure: conntrack-tools requires libnetfilter_conntrack 0.0.99 + * network: use NET_T_* instead of NFCT_Q_* + * ftfw: do not check for data messages in tx_queue_xmit + * ftfw: resync messages can be retransmitted + * network: do more strict message type checking + * ftfw: shrink alive message size + * sync-mode: check if message type is >= NET_T_STATE_MAX before + parsing + * src: cleanup, rename hashtable_test() by hashtable_find() + * cache: cleanup, rename __del2() by __del() + * netlink: log report initial netlink event socket buffer size + * doc: fix typo SocketBufferSizeMaxGrowth in example conffiles + * doc: document the netlink buffer size clauses + * doc: better documentation about ResendBufferSize + * x + * doc: revert commit 9bc7d7f8f333e79323495a193f92c9d4f1708da9 + * doc: add note on McastSndSocketBuffer and McastRcvSocketBuffer + * netlink: fix type in warning message on SocketBufferSizeMaxGrowth + * configure: bump version to 0.9.9 + * automake: add missing cidr.h + * headers: delete unused flags in conntrackd.h + * src: add network statistics via `-s network' + * src: add cache statistics via `-s cache' + * src: add run-time statistics via `-s runtime' + * sync-mode: remove unnecessary split lines + * conntrackd: fix missing \n in conntrackd -h + * cache_iterators: display the commit time taken in the logs + * cache_iterators: add total entries available in the cache to stats + * cache: fix ENOSPC errors due to over-population of inactive entries + * filter: skip filtering by state if the event has no state info + * run: show current netlink buffer size in `-s runtime' + * netlink: don't double the netlink buffer twice during resize + * src: constify hashtable parameter in hash() callbacks + * hashtable: use calloc instead of malloc + memset + * hashtable: check NULL instead of ! for pointers + * filter: add prefix ct_filter_ to hash and compare functions + * run: limit the number of iterations over the event handling + * src: rework of the hash-cache infrastructure + * cache: add status field to store the object status + * run: relax resynchronization algorithm when netlink overruns + * sync: unify tx_list and tx_queue into one single tx_queue + * ftfw: move helloing to ftfw_xmit() + * sync: add generic tx_queue for all synchronization modes + * sync: enqueue state updates to tx_queue + * network: do not re-set the message type in nethdr_set* functions + * src: support for redundant dedicated links + * src: rename overrun handler to resync handler + * src: remove register_fds hooks + * src: add state polling support (oppossed to current event-driven) + * cache: add objects statistics + * ftfw: add ResendQueueSize and deprecate ResendBufferSize clauses + * src: add `-s queue' and change `-v' behaviour + * conntrack: add -C command to display the counter + * src: obsolete `DestroyTimeout' clause + * conntrack: fix use of -u which is optional with -I + * cache_iterators: start a clean session if commit finds an entry + * cache: remove nl_exist_conntrack() function + * cache: mangle timeout inside nl_*_conntrack() functions + * src: don't clone when calling nl_*_conntrack functions + * src: change behaviour of `-t' option + * cache: move lifetime feature to main cache code + * src: add support for approximate timeout calculation during commit + * src: increase default PurgeTimeout value + * netlink: set IP_CT_TCP_FLAG_CLOSE_INIT for TIME_WAIT states + * doc: unset CommitTimeout by default + * doc: use 'From' instead of 'from' in the example configfiles + * doc: increase hashtable bucket size and limits in example files + * configure: bump version to 0.9.10 + + [ Jan Engelhardt ] + * build: upgrade build system + + [ Pablo Neira Ayuso ] + * build: replace INCLUDES by AM_CPPFLAGS according to autoreconf + * configure: conntrack-tools >= 0.9.10 requires libnfnetlink >= 0.0.40 + * netlink: refactorize several nl_init_*_handler() functions + * src: re-work polling strategy + * netlink: add new option NetlinkOverrunResync + * sync-mode: flush also internal cache after reset PurgeTimeout + * conntrack: allow use of --state with -D + * src: add Nice clause to set the nice value + * config: nl_overrun must be signed int instead of unsigned + * cache_iterators: fix wrong printf format in commit-time message + * src: use resync handler for polling instead of dump handler + * stats-mode: fix polling based logging + * conntrackd: add `-f internal' and `-f external' options + * conntrackd: display help information with `-h' + * conntrackd: don't initialize logging for client request + * doc: unset ACKWindowSize in example configuration files + * doc: add new primary-backup.sh script for >= 2.6.29 + * doc: add bulk update to primary-script.sh script + * headers: don't use NFCT_DIR_MAX in statistics structure + * network: fix endianess issue in synchronization network header + * network: fix endianess issue in acknowledgment network header + * sync-mode: change current link if message is correct + * src: remove obsolete debug() and debug_ct() calls + * doc: revert primary-backup-2.6.29-and-higher.sh script + * mcast: fix compilation warning due missing header + * config: add NetlinkBufferSize and NetlinkBufferSizeMaxGrowth + * netlink: use u8 getter for TCP states + * build: bump version to 0.9.11 + * src: fix compilation issue in gentoo due to missing include limits.h + + [ Jan Engelhardt ] + * build: add m4 directory + + [ Pablo Neira Ayuso ] + * doc: fix broken link to ulogd2 in the manual + * extensions: remove use of old libnetfilter API flags + * src: remove debian/ directory + * sync-mode: rename mcast_send_sync() to sync_send() + * sync-mode: rename mcast_iface structure to interface + * sync-mode: add abstract layer to make daemon independent of + multicast + * sync-mode: rename mcast_track_*() by nethdr_track_*() + * sync-mode: add unicast UDP support to propagate state-changes + * sync-mode: fix wrong output stats refering lost/malformed packets + * sync-mode: save one tab inside switch, cleanup + * sync-mode: cleanup reminiscent of multicast dependency + * mcast: mcast_send() takes a const pointer to buffer + * sync-mode: change `multicast' by `link' for `-s' option + * parse: fix broken destination port address translation + * udp: fix missing scope_id in the socket creation + * mcast: remove several unused structure fields + * config: obsolete `ListenTo' clause + * sync-mode: fix broken dedicated-link change in multichannel layer + * conntrack: fix missing bits in `-C' command + * conntrack: add `-S' command to display kernel statistics + * conntrack: remove broken command checking code + * doc: set nice to -20 in example config files + * config: cleanup error reporting during config file parsing + * build: bump version to 0.9.12 + * daemon: remove unused constants in header file + * conntrack: remove hardcoded iteration in TCP support + * conntrack: cleanup error output with `-p tcp --state' + * conntrack: save one indent in the TCP support + * conntrack: fix coupled-options sanity checkings + * conntrack: add UDPlite support + * conntrack: add SCTP support + * conntrack: add DCCP support + * conntrackd: change scheduler and priority via configuration file + * conntrack: fix English typo in output message + * conntrack: add GRE support + * sync: add support for SCTP state replication + * conntrack: add DCCP role parameter for conntrack creation + * sync: add support for DCCP state replication + + [ Samuel Gauthier ] + * build: use uint16_t instead of uint32_t for uint16_t attributes + + [ Pablo Neira Ayuso ] + * conntrackd: add child process infrastructure + * conntrackd: detect where the events comes from + * conntrackd: flush operation use the child process and origin + infrastructure + * conntrackd: remove the cache write-through policy + * conntrackd: remove redudant declaration of Port in the parser + * conntrackd: remove an unused extern declaration in cache.h + + [ Thomas Jarosch ] + * build: Added "m4" directory to make dist + + [ Pablo Neira Ayuso ] + * src: remove obsolete changelog file + * conntrackd: remove unused request nfct handler + * conntrackd: add missing initialization of PID in process + infrastructure + * conntrackd: block signals during the access to the process list + * conntrackd: allow to limit the number of simultaneous child + processes + * conntrackd: use a permanent handler for flush operations + * conntrackd: use a permanent handler for commit operations + * conntrackd: add support to display statistics on existing child + processes + * build: use TLV format for SCTP/DCCP protocol information + * conntrackd: rename `-s queue' option by `-s rsqueue' + * conntrackd: add the name field to queues + * conntrackd: add `-s queue' to display queue statistics + * conntrackd: add statistics about queue node objects + * conntrackd: add statistics for enospc errors in queues + * conntrackd: fix memory leak in cache_update_force() + * conntrackd: fix wrong TCP handling in unused nl_update_conntrack() + * conntrack: fix English typo in documentation + * build: bump version to 0.9.13 + * build: update library version requirements + + [ Jan Engelhardt ] + * doc: spell fix in conntrack(8) manpage + + [ Pablo Neira Ayuso ] + * local: add LOCAL_RET_* return values for UNIX sockets callbacks + * conntrackd: add iterators with limited steps in hash and cache types + * conntrackd: rework commit not to fork a child process + * conntrackd: improve handling of external messages + * conntrackd: reset event limit iteration counter + * conntrackd: add clause to enable ctnetlink reliable event delivery + * conntrackd: add support for IPv6 kernel-space filtering via BSF + * conntrackd: use conntrack ID in the cache lookup + * conntrackd: fix crash for unubuffered channel on exit path + * conntrackd: more robust sanity checking on synchronization messages + * conntrackd: add `DisableExternalCache' clause + * conntrackd: reduce the number of gettimeofday() syscalls + * conntrackd: allow to remove file descriptors from set + * conntrackd: add support state-replication based on TCP + * conntrackd: net message memory allocation is unsafe + + [ Samuel Gauthier ] + * conntrackd: better parse_payload protection against corrupted + packets + * conntrackd: fix bad configuration file for DisableExternalCache + statement + + [ Pablo Neira Ayuso ] + * conntrackd: fix MTU for TCP channels + * conntrackd: fix return value in notrack_local() + * conntrackd: improve error handling in tcp_send + * conntrackd: fix `conf' local variable in channel.c that shadows + global + * conntrackd: fix re-connect with multiple TCP channels + * conntrackd: break lines at 80 characters in example config files + * conntrackd: rate-limit the amount of connect() calls + * conntrackd: add retention queue for TCP errors + * conntrackd: add alive control messages to notrack mode + * conntrackd: fix wrong calculation of new maxfd on unregister_fds() + + [ Hannes Eder ] + * conntrack: fix output when no arguments are passed + * conntrack: avoid error with expectations when using 'conntrack -E -e + ALL ...' + * conntrack: use fscanf() instead of read() for showing counter + + [ Pablo Neira Ayuso ] + * conntrackd: add statistics when the external cache is disabled + * conntrackd: add missing external statistics + * conntrackd: add `DisableInternalCache' clause + * conntrackd: use indirect call to build layer 4 protocol information + * conntrackd: add ICMP support for state-synchronization + * conntrackd: fix flow-state filtering for TCP + * conntrackd: document internal cache disabling and TCP-based + synchronization + * conntrack: fix manually created TCP entries with window tracking + enabled + * conntrackd: document `-B' command + * build: bump version to 0.9.14 + * conntrackd: fix UDP filtering in configuration file + * conntrackd: add support for TCP window scale factor synchronization + * conntrackd: cleanup port addition in the message building path + * conntrackd: fix `conntrackd -c' if external cache is disabled + * conntrack: option `-t' in on the same line as `-m' in manpage + * conntrackd: PollSecs goes in the General clause for statistics + * conntrackd: split __run() routine for poll and event-driven modes + * doc: description on how to block traffic with conntrack was + incomplete + * conntrack: fix `-L --src-nat --dst-nat' + + [ Mohit Mehta ] + * conntrackd: `-i -x' does not display internal cache in XML + + [ Pablo Neira Ayuso ] + * conntrack: revert fix `-L --src-nat --dst-nat' + * conntrack: fix `conntrack -L --src-nat --dst-nat' (second try) + * conntrack: `-L --src-nat --dst-nat' filter using AND, not OR logic + * conntrackd: complete TCP window scale support + * conntrack: expand array that maps option-flags to option-names + * conntrack: put all the commands and options code together + * conntrack: fix port filter with `--src-nat' and `--dst-nat' + * conntrack: add `--any-nat' to filter any NATted flow + * conntrack: add testsuite for NAT filtering options + * conntrack: re-fix inconsistent display with `--src-nat' and `--dst- + nat' + * conntrack: fix bogus NATted flows in filtering + * conntrack: fix `conntrack --src-nat 3.3.3.3' and similar + * conntrack: fix `conntrack --src-nat 1.1.1.1' if PAT applied + * conntrack: fix `conntrack --any-nat 1.1.1.1' filtering + * conntrack: --[src|dst|any]-nat requires IP:PORT as argument + * conntrack: fix `conntrack --[src|dst|any]-nat IP:PORT' if port + mismatches + * conntrack: cleanup parsing of the NAT arguments + + [ Mohit Mehta ] + * conntrackd: update error message for max netlink socket size reached + + [ Pablo Neira Ayuso ] + * conntrackd: fix ICMPv6 support + * conntrack: add zone support + + [ Mohit Mehta ] + * conntrackd: enforce strict logic for NetlinkBufferSize[*] clauses + + [ Pablo Neira Ayuso ] + * conntrackd: open event handler once cache has been populated + * conntrackd: setup event reliability after handler creation + + [ Mohit Mehta ] + * conntrackd: replace cryptic `mfrm' by `malformed' in `-s' + + [ Pablo Neira Ayuso ] + * conntrackd: fix parsing of NAT sequence adjustment in + synchronization messages + * conntrackd: warn on TCPWindowTracking option (it requires kernel >= + 2.6.35) + * build: update libnetfilter_conntrack dependency (>= 0.0.102) + * build: bump version to 0.9.15 + * conntrackd: fix wrong kernel requirements for TCPWindowTracking in + example files + * conntrackd: minor documentation update (two new questions in the + FAQ) + * conntrack: fix missing line break in conntrack(8) manpage + * conntrack: allow to listen to all kind of expectation events + + [ Jan Engelhardt ] + * build: use autoconf-suggested naming of files + * build: use modern call syntax for AM_INIT_AUTOMAKE + * build: drop unused $(all_includes) + * build: remove statements without effect + * build: remove unused $(all_libraries) + * build: no need for error message in PKG_CHECK_MODULES + * Add .gitignore files + * build: resolve automake warning + * build: default to not building static libraries + * build: run autoupdate to replace obsolete constructs + * build: use AM_YFLAGS instead of overriding YACC + * build: remove redundant bison/lex tests + + [ Pablo Neira Ayuso ] + * doc: update conntrack-tools manual + * doc: remove reference to the CT target + * local: don't override initial return value + * sync: don't override initial return value of local handler + * cache: close commit request if we already have one in progress + * cache: log if we received a commit request while already one in + progress + * conntrackd: event iteration limiter is already reset in main select + loop + * conntrackd: rise number of committed entries per step + * conntrack: add -o ktimestamp option (it requires linux >= 2.6.38) + * conntrackd: use nfct_copy() with override flag in cache_object_new() + * conntrack: allocate template objects in the heap + * conntrackd: remove use of deprecated nfct_maxsize() + * doc: document -s option of conntrackd in the manual + * doc: document redundant link support for conntrackd + * conntrack: display informative message if expectation table is + flushed + * conntrack: support SYN_SENT2 TCP state as --state parameter + * doc: add reference to the CT target again + * doc: add missing conntrackd -s invocation with options + * build: conntrack-tools now requires libnetfilter_conntrack >= 0.9.1 + * doc: prepare 1.0.0 release in conntrack-tools manual + * build: bump version to 1.0.0 + * build: Linux kernel-style for compilation messages + + [ Florian Westphal ] + * conntrack: add support for mark mask + * conntrack: skip sending update message to kernel if conntrack is + unchanged + + [ Pablo Neira Ayuso ] + * conntrack: remove unused variable with -S + + [ Florian Westphal ] + * testsuite: add tests for --mark option + * conntrack: add missing break when parsing --id/--secmark options + + [ Pablo Neira Ayuso ] + * conntrackd: add missing initial caching of gettimeofday() + + [ Jan Engelhardt ] + * Update .gitignore + * build: use AC_CONFIG_AUX_DIR and stash away tools + * build: disable implicit .tar.gz archive generation and use POSIX + mode + + [ Pablo Neira Ayuso ] + * conntrackd: fix filtering of dump output if internal cache is + disabled + * doc: primary-backup.sh: clarify licensing terms (GPLv2+) + * conntrackd: fix checking of return value of queue_add() + * build: bump version to 1.0.1 + * conntrackd: generalize caching infrastructure + * conntrackd: generalize external handlers to prepare expectation + support + * conntrackd: generalize/cleanup network message building/parsing + * conntrackd: generalize local handler actions + * conntrackd: simplify cache_get_extra function + * conntrackd: remove cache_data_get_object and replace by direct + pointer + * conntrackd: constify ct parameter of ct_filter_* functions + * conntrackd: relax checkings in ct_filter_sanity_check + * conntrackd: minor cleanup for commit + * conntrackd: support for expectation synchronization + * doc: update conntrack-tools manual to detail expectation support + + [ Gaurav Sinha ] + * updating changelog for merge of expect-sync and oxnard + + -- Gaurav Sinha <gaurav.sinha@vyatta.com> Fri, 20 Jan 2012 15:55:05 -0800 + conntrack (0.9.14-2+vyatta14) unstable; urgency=low * Collapse of expect-sync branch to oxnard. Brings in support for expect table sync. |