diff options
| -rw-r--r-- | ChangeLog | 8 | ||||
| -rw-r--r-- | Makefile.am | 2 | ||||
| -rw-r--r-- | TODO | 42 | ||||
| -rw-r--r-- | configure.in | 2 | ||||
| -rw-r--r-- | conntrack.8 | 5 | ||||
| -rw-r--r-- | conntrackd.8 | 81 | ||||
| -rw-r--r-- | include/conntrack.h | 5 | ||||
| -rw-r--r-- | src/build.c | 2 | ||||
| -rw-r--r-- | src/conntrack.c | 55 | ||||
| -rw-r--r-- | src/parse.c | 1 |
10 files changed, 158 insertions, 45 deletions
@@ -4,10 +4,18 @@ version 0.9.6 (yet unreleased) o fix compilation problem due to missing headers (Krisztian Kovacs) o include kernel options and Fedora comments in the INSTALL file += conntrack = +o fix missing `-g' and `-n' options in getopt_long control string +o add support for secmark (requires Linux kernel >= 2.6.25) +o add mark and secmark information to the manpage +o cleanup error message + = conntrackd = o Remove window tracking disabling limitation (requires Linux kernel >= 2.6.22) o syslog support (based on patch from Simon Lodal) o add CacheWriteThrough clause: external cache write through policy +o add support for secmark (requires Linux kernel >= 2.6.25) +o add conntrackd (8) manpage version 0.9.5 (2007/07/29) ------------------------------ diff --git a/Makefile.am b/Makefile.am index 239eedf..3abf2cc 100644 --- a/Makefile.am +++ b/Makefile.am @@ -4,7 +4,7 @@ include Make_global.am # have all needed files, that a GNU package needs AUTOMAKE_OPTIONS = foreign dist-bzip2 1.6 -man_MANS = conntrack.8 +man_MANS = conntrack.8 conntrackd.8 EXTRA_DIST = $(man_MANS) Make_global.am ChangeLog TODO examples SUBDIRS = extensions src @@ -2,28 +2,32 @@ There are several tasks that are pending to be done, I have classified them by dificulty levels: = Relatively easy = - * add syslog support (based on Simon Lodal's patch) - * improve shell scripts for keepalived/heartbeat: *really* important - * use NACK based protocol, feedback: call pablo :-) - * manpage for conntrackd(8) - * use the floating priority feature in keepalived to avoid premature - take over. + [ ] improve shell scripts for keepalived/heartbeat: *really* important + [ ] NACK as default protocol + [ ] rename persistent to alarm + [X] manpage for conntrackd(8) + [ ] add scripts to use the floating priority feature in keepalived to avoid + premature take over. + [ ] ignorepool with unlimited size and ignore networks + [ ] selective conntracks removal + [ ] debian/rpm packages + [ ] improve website + [ ] Dumazet improvement hashtable (multiply vs. divide) + [X] add secmark support = Requires some work = - * study better keepalived transitions - * test/fix ipv6 support - * have a look at open issues - * implement support for TCP window tracking (patches are on the table) at - the moment you have to disable it: + [ ] study better keepalived transitions + [ ] test/fix ipv6 support + [ ] add support setup related conntracks + [ ] NAT sequence adjustment support - echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal - -= Requires kernel patches = - * setup master conntrack to match IPCT_RELATED - -= Open issues = - * unsupported iptables matches: += Open issues that won't be ever resolved = + * unsupported stateful iptables matches: * connbytes: probably the persistent may support it * recent: requires further study * quota: private data counters - * connection tracking NAT helpers: sequence adjustment issues (?) + += conntrack = + * add support for -D --dport 1000 + * improve error messages + * add support for SCTP (requires kernel >= 2.6.25) diff --git a/configure.in b/configure.in index 9400e37..bcd43f2 100644 --- a/configure.in +++ b/configure.in @@ -18,7 +18,7 @@ esac dnl Dependencies LIBNFNETLINK_REQUIRED=0.0.25 -LIBNETFILTER_CONNTRACK_REQUIRED=0.0.82 +LIBNETFILTER_CONNTRACK_REQUIRED=0.0.87 PKG_CHECK_MODULES(LIBNFNETLINK, libnfnetlink >= $LIBNFNETLINK_REQUIRED,, AC_MSG_ERROR(Cannot find libnfnetlink >= $LIBNFNETLINK_REQUIRED)) diff --git a/conntrack.8 b/conntrack.8 index d095d6c..0924888 100644 --- a/conntrack.8 +++ b/conntrack.8 @@ -106,6 +106,11 @@ This option is only required in conjunction with "-L, --dump". If this option is .TP .BI "-t, --timeout " "TIMEOUT" Specify the timeout. +.BI "-m, --mark " "MARK" +Specify the conntrack mark. +.TP +.BI "-c, --secmark " "SECMARK" +Specify the conntrack selinux security mark. .TP .BI "-u, --status " "[ASSURED|SEEN_REPLY|UNSET][,...]" Specify the conntrack status. diff --git a/conntrackd.8 b/conntrackd.8 new file mode 100644 index 0000000..8e2f2cc --- /dev/null +++ b/conntrackd.8 @@ -0,0 +1,81 @@ +.TH CONNTRACKD 8 "Dec 21, 2007" "" "" + +.\" Man page written by Pablo Neira Ayuso <pablo@netfilter.org> (Dec 2007) + +.SH NAME +conntrackd \- netfilter connection tracking userspace daemon +.SH SYNOPSIS +.BR "conntrackd [options]" +.SH DESCRIPTION +.B conntrackd +provides a userspace daemon for the netfilter connection tracking system. This daemon synchronizes connection tracking states among several replica firewalls. Thus, +.B conntrackd +can be used to implement highly available stateful firewalls. The daemon fully supports Primary-Backup and Multiprimary setups for both symmetric and asymmetric paths. It can also be used as statistics collector. +.SH OPTIONS +The options recognized by +.B conntrackd +can be divided into several different groups. +.SS MODES +These options specify the particular operation mode in which conntrackd runs. Only one of them can be specified at any given time. +.TP +.BI "-d " +Run conntrackd in daemon mode. This option can be combined with "-S" +.TP +.BI "-S " +Run conntrackd in statistics mode. Default mode is synchronization mode, so if you want to use +.B conntrackd +in statistics mode, you have to pass this option +.SS CLIENT COMMANDS +.B conntrackd +can be used in client mode to request several information and operations to a running daemon +.TP +.BI "-i " +Dump the internal cache, i.e. show local states +.TP +.BI "-e " +Dump the external cache, i.e. show foreign states +.TP +.BI "-x " +Display output in XML format. This option is only valid in combination +with "-i" and "-e" parameters. +.TP +.BI "-f " +Flush the internal and the external cache +.TP +.BI "-k " +Kill the daemon +.TP +.BI "-s " +Dump statistics +.TP +.BI "-R " +Force a resync against the kernel connection tracking table +.SH DIAGNOSTICS +The exit code is 0 for correct function. Errors cause an exit code of 1. +.SH EXAMPLES +.TP +.B conntrackd \-d +Runs conntrackd in daemon and synchronization mode +.TP +.B conntrackd \-i +Dumps the states held in the internal cache, i.e. those handled by this firewall +.TP +.B conntrackd \-e +Dumps the states held in the external cache, i.e. those handled by other replica firewalls +.TP +.B conntrackd \-c +Commits the internal cache into the kernel connection tracking system. This is used to inject the state so that the connections can be recovered during the failover. +.SH DEPENDENCIES +This daemon requires a Linux kernel version >= 2.6.18. TCP window tracking support requires >= 2.6.22, otherwise you have to disable it. Helpers are fully supported since >= 2.6.25, however, if you use any previous version, depending on the protocol helper and your setup (e.g. if you setup performs NAT sequence adjustments or not), your help connection may be successfully recovered. +.TP +There are several unsupported stateful iptables matches such as recent, connbytes and the quota matches which gather internal information to operate. Since that information does not belong to the domain of the connection tracking system, connections affected by those matches may not be fully recovered during the takeover. +.SH SEE ALSO +.BR conntrack (8), iptables (8) +.br +.BR "http://people.netfilter.org/pablo/conntrack-tools/" +.SH AUTHORS +Pablo Neira Ayuso wrote and maintains the conntrackd tool +.TP +Please send bug reports to <netfilter-failover@lists.netfilter.org>. Subscription is required. +.PP +Man page written by Pablo Neira Ayuso <pablo@netfilter.org>. diff --git a/include/conntrack.h b/include/conntrack.h index 5edc0e9..1b2581e 100644 --- a/include/conntrack.h +++ b/include/conntrack.h @@ -127,7 +127,10 @@ enum options { CT_OPT_OUTPUT_BIT = 19, CT_OPT_OUTPUT = (1 << CT_OPT_OUTPUT_BIT), - CT_OPT_MAX = CT_OPT_OUTPUT_BIT + CT_OPT_SECMARK_BIT = 20, + CT_OPT_SECMARK = (1 << CT_OPT_SECMARK_BIT), + + CT_OPT_MAX = CT_OPT_SECMARK_BIT }; #define NUMBER_OF_OPT CT_OPT_MAX+1 diff --git a/src/build.c b/src/build.c index 981548e..109b26e 100644 --- a/src/build.c +++ b/src/build.c @@ -97,6 +97,8 @@ void build_netpld(struct nf_conntrack *ct, struct netpld *pld, int query) __build_u32(ct, pld, ATTR_TIMEOUT); if (nfct_attr_is_set(ct, ATTR_MARK)) __build_u32(ct, pld, ATTR_MARK); + if (nfct_attr_is_set(ct, ATTR_SECMARK)) + __build_u32(ct, pld, ATTR_SECMARK); if (nfct_attr_is_set(ct, ATTR_STATUS)) __build_u32(ct, pld, ATTR_STATUS); diff --git a/src/conntrack.c b/src/conntrack.c index 165809b..65dc4a7 100644 --- a/src/conntrack.c +++ b/src/conntrack.c @@ -67,7 +67,7 @@ static const char cmd_need_param[NUMBER_OF_CMD] static const char *optflags[NUMBER_OF_OPT] = { "src","dst","reply-src","reply-dst","protonum","timeout","status","zero", "event-mask","tuple-src","tuple-dst","mask-src","mask-dst","nat-range","mark", -"id","family","src-nat","dst-nat","output" }; +"id","family","src-nat","dst-nat","output","secmark"}; static struct option original_opts[] = { {"dump", 2, 0, 'L'}, @@ -96,6 +96,7 @@ static struct option original_opts[] = { {"mask-dst", 1, 0, '}'}, {"nat-range", 1, 0, 'a'}, /* deprecated */ {"mark", 1, 0, 'm'}, + {"secmark", 1, 0, 'c'}, {"id", 2, 0, 'i'}, /* deprecated */ {"family", 1, 0, 'f'}, {"src-nat", 2, 0, 'n'}, @@ -122,22 +123,22 @@ static unsigned int global_option_offset = 0; static char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] = /* Well, it's better than "Re: Linux vs FreeBSD" */ { - /* s d r q p t u z e [ ] { } a m i f n g o */ -/*CT_LIST*/ {2,2,2,2,2,0,0,2,0,0,0,0,0,0,2,2,2,2,2,2}, -/*CT_CREATE*/ {2,2,2,2,1,1,1,0,0,0,0,0,0,2,2,0,0,2,2,0}, -/*CT_UPDATE*/ {2,2,2,2,1,2,2,0,0,0,0,0,0,0,2,2,0,0,0,0}, -/*CT_DELETE*/ {2,2,2,2,2,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0}, -/*CT_GET*/ {2,2,2,2,1,0,0,0,0,0,0,0,0,0,0,2,0,0,0,2}, -/*CT_FLUSH*/ {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, -/*CT_EVENT*/ {2,2,2,2,2,0,0,0,2,0,0,0,0,0,2,0,0,2,2,2}, -/*VERSION*/ {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, -/*HELP*/ {0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, -/*EXP_LIST*/ {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,2,0,0,0}, -/*EXP_CREATE*/{1,1,2,2,1,1,2,0,0,1,1,1,1,0,0,0,0,0,0,0}, -/*EXP_DELETE*/{1,1,2,2,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, -/*EXP_GET*/ {1,1,2,2,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, -/*EXP_FLUSH*/ {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, -/*EXP_EVENT*/ {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, + /* s d r q p t u z e [ ] { } a m i f n g o c */ +/*CT_LIST*/ {2,2,2,2,2,0,0,2,0,0,0,0,0,0,2,2,2,2,2,2,2}, +/*CT_CREATE*/ {2,2,2,2,1,1,1,0,0,0,0,0,0,2,2,0,0,2,2,0,2}, +/*CT_UPDATE*/ {2,2,2,2,1,2,2,0,0,0,0,0,0,0,2,2,0,0,0,0,2}, +/*CT_DELETE*/ {2,2,2,2,2,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0}, +/*CT_GET*/ {2,2,2,2,1,0,0,0,0,0,0,0,0,0,0,2,0,0,0,2,0}, +/*CT_FLUSH*/ {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, +/*CT_EVENT*/ {2,2,2,2,2,0,0,0,2,0,0,0,0,0,2,0,0,2,2,2,2}, +/*VERSION*/ {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, +/*HELP*/ {0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, +/*EXP_LIST*/ {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,2,0,0,0,0}, +/*EXP_CREATE*/{1,1,2,2,1,1,2,0,0,1,1,1,1,0,0,0,0,0,0,0,0}, +/*EXP_DELETE*/{1,1,2,2,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, +/*EXP_GET*/ {1,1,2,2,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, +/*EXP_FLUSH*/ {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, +/*EXP_EVENT*/ {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0}, }; static LIST_HEAD(proto_list); @@ -145,7 +146,8 @@ static LIST_HEAD(proto_list); static unsigned int options; static unsigned int command; -#define CT_COMPARISON (CT_OPT_PROTO | CT_OPT_ORIG | CT_OPT_REPL | CT_OPT_MARK) +#define CT_COMPARISON (CT_OPT_PROTO | CT_OPT_ORIG | CT_OPT_REPL | CT_OPT_MARK |\ + CT_OPT_SECMARK) void register_proto(struct ctproto_handler *h) { @@ -206,7 +208,6 @@ void exit_error(enum exittype status, char *msg, ...) fprintf(stderr,"%s v%s: ", PROGNAME, VERSION); vfprintf(stderr, msg, args); va_end(args); - fprintf(stderr, "\n"); if (status == PARAMETER_PROBLEM) exit_tryhelp(status); exit(status); @@ -522,6 +523,7 @@ static const char usage_conntrack_parameters[] = " -n, --src-nat ip\t\t\tsource NAT ip\n" " -g, --dst-nat ip\t\t\tdestination NAT ip\n" " -m, --mark mark\t\t\tSet mark\n" + " -c, --secmark secmark\t\t\tSet selinux secmark\n" " -e, --event-mask eventmask\t\tEvent mask, eg. NEW,DESTROY\n" " -z, --zero \t\t\t\tZero counters while listing\n" " -o, --output type[,...]\t\tOutput format, eg. xml\n"; @@ -556,7 +558,7 @@ void usage(char *prog) { fprintf(stdout, "\n%s", usage_tables); fprintf(stdout, "\n%s", usage_conntrack_parameters); fprintf(stdout, "\n%s", usage_expectation_parameters); - fprintf(stdout, "\n%s", usage_parameters); + fprintf(stdout, "\n%s\n", usage_parameters); } static unsigned int output_mask; @@ -677,9 +679,10 @@ int main(int argc, char *argv[]) register_udp(); register_icmp(); - while ((c = getopt_long(argc, argv, - "L::I::U::D::G::E::F::hVs:d:r:q:p:t:u:e:a:z[:]:{:}:m:i::f:o:", - opts, NULL)) != -1) { + while ((c = getopt_long(argc, argv, "L::I::U::D::G::E::F::hVs:d:r:q:" + "p:t:u:e:a:z[:]:{:}:m:i::f:o:n::" + "g::c:", + opts, NULL)) != -1) { switch(c) { case 'L': type = check_type(argc, argv); @@ -948,6 +951,12 @@ int main(int argc, char *argv[]) continue; nfct_set_attr_u32(obj, ATTR_MARK, atol(optarg)); break; + case 'c': + options |= CT_OPT_SECMARK; + if (!optarg) + continue; + nfct_set_attr_u32(obj, ATTR_SECMARK, atol(optarg)); + break; case 'i': printf("warning: ignoring --id. deprecated option.\n"); break; diff --git a/src/parse.c b/src/parse.c index 81b70c4..8816e7a 100644 --- a/src/parse.c +++ b/src/parse.c @@ -55,6 +55,7 @@ parse h[ATTR_MAX] = { [ATTR_TIMEOUT] = parse_u32, [ATTR_MARK] = parse_u32, [ATTR_STATUS] = parse_u32, + [ATTR_SECMARK] = parse_u32, }; void parse_netpld(struct nf_conntrack *ct, struct netpld *pld, int *query) |