summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2010-12-28new branchAn-Cheng Huang
2010-11-05build: remove redundant bison/lex testsJan Engelhardt
AC_PROG_{LEX,YACC} already searches for the programs, so no need to do it again with AC_CHECK_PROGS. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-11-05build: use AM_YFLAGS instead of overriding YACCJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-11-05build: run autoupdate to replace obsolete constructsJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-11-05build: default to not building static librariesJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-11-05build: resolve automake warningJan Engelhardt
src/Makefile.am:24: whitespace following trailing backslash Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31Add .gitignore filesJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: no need for error message in PKG_CHECK_MODULESJan Engelhardt
PKG_CHECK_MODULES already produces its own (and more verbose) messsage when a module cannot be found. Mucking around with CFLAGS and LIBS is also not needed since pkgconfig takes care of providing variables, so let's use them in Makefile.am. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: remove unused $(all_libraries)Jan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: remove statements without effectJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: drop unused $(all_includes)Jan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: use modern call syntax for AM_INIT_AUTOMAKEJan Engelhardt
automake options also need to definitely go into configure.ac, otherwise they only apply to a single directory. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: use autoconf-suggested naming of filesJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-12conntrack: allow to listen to all kind of expectation eventsPablo Neira Ayuso
So far, conntrack only allows to listen to events of new expectations. With this patch, we can listen to events of destroyed expectations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-10-12conntrack: fix missing line break in conntrack(8) manpagePablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-09-020.9.14-2+vyatta11debian/0.9.14-2+vyatta11An-Cheng Huang
2010-08-310.9.14-2+vyatta10debian/0.9.14-2+vyatta10An-Cheng Huang
2010-08-31remove debian patching from buildAn-Cheng Huang
2010-08-04conntrackd: minor documentation update (two new questions in the FAQ)Pablo Neira Ayuso
This patch includes a minor documentation update with two new questions in the FAQ. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-08-04conntrackd: fix wrong kernel requirements for TCPWindowTracking in example filesPablo Neira Ayuso
This patch fixes wrong Linux kernel requirements in the example configuration files. We require a Linux kernel >= 2.6.36 instead of >= 2.6.35 as the files suggest. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-220.9.14-2+vyatta9debian/0.9.14-2+vyatta9An-Cheng Huang
2010-07-15build: bump version to 0.9.15conntrack-tools-0.9.15Pablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-15build: update libnetfilter_conntrack dependency (>= 0.0.102)Pablo Neira Ayuso
We require the latest libnetfilter_conntrack version to fix several bugs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-15conntrackd: warn on TCPWindowTracking option (it requires kernel >= 2.6.35)Pablo Neira Ayuso
This patch adds a comment on the TCPWindowTracking option to warn that this will be supported since the Linux kernel 2.6.35. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-13conntrackd: fix parsing of NAT sequence adjustment in synchronization messagesPablo Neira Ayuso
This patch fixes a bug that results in an incorrect parsing of the NAT sequence adjustment in synchronization messages. Spotted by Adam Gundy in the following message that was sent to the netfilter ML: http://marc.info/?l=netfilter&m=127894708222913&w=2 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-090.9.14-2+vyatta8debian/0.9.14-2+vyatta8Mohit Mehta
2010-07-09conntrackd: replace cyptic 'mfrm' with 'malformed' in '-s'Mohit Mehta
2010-07-09conntrackd: replace cryptic `mfrm' by `malformed' in `-s'Mohit Mehta
Looking at the output of `conntrackd -s`; I didn't know what 'mfrm' meant under the 'message sequence tracking' section so I had to look up the code for this. While doing so, I replaced 'mfrm' with 'malformed' in the output since I thought other users might be confused as well as I was looking at that word. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-070.9.14-2+vyatta7debian/0.9.14-2+vyatta7Mohit Mehta
2010-07-07conntrackd: setup event reliability after handler creationPablo Neira Ayuso
This patch enables the event reliability in an early stage of the event handler initialization. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-07conntrackd: open event handler once cache has been populatedPablo Neira Ayuso
With this patch, we open the event handler once the internal cache (if any) is populated. This reduces the chances of a possible premature overrun if we lauch conntrackd in a busy firewall. However, we may still start with an internal cache that may differ a bit from the once in the kernel. This patch has no impact in setups where conntrackd is started in a spare firewall. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-07conntrackd: enforce strict logic for NetlinkBufferSize[*] clausesMohit Mehta
- NetlinkBufferSize value passed to the kernel gets doubled [see SO_RCVBUF in net/core/sock.c]; it's halved now before it gets sent to the kernel. This ensures that daemon starts up with a netlink socket buffer size equal to the value set for NetlinkBufferSize in configuration file. - Previously, netlink socket buffer size would only stop increasing after it had increased beyond NetlinkBufferSizeMaxGrowth value. With this commit netlink socket buffer size increases as long as it is less than or equal to NetlinkBufferSizeMaxGrowth value. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-05conntrack: add zone supportPablo Neira Ayuso
This patch adds `--zone' to the command line tool. This adds the missing user-space support for Patrick's McHardy iptables CT target. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01Enforce strict logic for NetlinkBufferSize, NetlinkBufferSizeMaxGrowth clausesMohit Mehta
* NetlinkBufferSize value passed to the kernel gets doubled [see SO_RCVBUF in net/core/sock.c]; it's halved now before it gets sent to the kernel. This ensures that daemon starts up with a netlink socket buffer size equal to the value set for NetlinkBufferSize in configuration file * Previously, netlink socket buffer size would only stop increasing after it had increased beyond NetlinkBufferSizeMaxGrowth value. With this commit netlink socket buffer size increases as long as it is less than or equal to NetlinkBufferSizeMaxGrowth value
2010-07-010.9.14-2+vyatta6debian/0.9.14-2+vyatta6Mohit Mehta
2010-07-01conntrackd: fix ICMPv6 supportPablo Neira Ayuso
This patch fixes several minor nitpicks to support IPv6 failover: * ICMPv6 type/code/id were missing in synchronization messages. * The use of '-' as string in the configuration file was not allowed. * Include example in configuration file under doc/. Reported-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrackd: update error message for max netlink socket size reachedMohit Mehta
It must refer to NetlinkBufferSize[*] instead of "SocketBufferSize[*]. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: cleanup parsing of the NAT argumentsPablo Neira Ayuso
This patch cleans up nat_parse() and it also displays nicer error message for malformed arguments. % conntrack -L --src-nat :80 conntrack v0.9.14 (conntrack-tools): No IP specified Try `conntrack -h' or 'conntrack --help' for more information. % conntrack -L --src-nat 1.1.1.1: conntrack v0.9.14 (conntrack-tools): No port specified after `:' Try `conntrack -h' or 'conntrack --help' for more information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --[src|dst|any]-nat IP:PORT' if port mismatchesPablo Neira Ayuso
This patch fixes the filtering if the IP matches an entry but the PORT does not matches. Without this patch, the entry is shown when it should be not. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: --[src|dst|any]-nat requires IP:PORT as argumentPablo Neira Ayuso
This patch restricts the behaviour that we previously introduced in 142606c60808b3ab0496155ac3d086765e6baef3. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --any-nat 1.1.1.1' filteringPablo Neira Ayuso
This patch adds the missing bits to allow to filter with --any-nat based on the IP address. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --src-nat 1.1.1.1' if PAT appliedPablo Neira Ayuso
This patch fixes another scenario in which the flow has some PAT mangling and we passed the src-nat address that we want to use to perform the filtering. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --src-nat 3.3.3.3' and similarPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix bogus NATted flows in filteringPablo Neira Ayuso
With this patch, conntrack does not show bogus entries that have no NAT applied due to a relaxed checking. conntrack -L --src-nat :80 tcp 6 342824 ESTABLISHED src=XX.214.188.80 dst=66.XX.7.180 sport=80 dport=13749 packets=4 bytes=6000 [UNREPLIED] src=66.XX.7.180 dst=XX.214.188.80 sport=13749 dport=80 packets=0 bytes=0 mark=0 secmark=0 use=1 conntrack v0.9.14 (conntrack-tools): 1 flow entries have been shown. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: re-fix inconsistent display with `--src-nat' and `--dst-nat'Pablo Neira Ayuso
In 142606c60808b3ab0496155ac3d086765e6baef3, I re-introduced the inconsistent behaviour that I described in 85f94171a71880c744f265268f33ad58819caa74. Great. This patch fixes this again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: add testsuite for NAT filtering optionsPablo Neira Ayuso
This patch adds the testsuite for the NAT filtering options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: add `--any-nat' to filter any NATted flowPablo Neira Ayuso
This patch adds the --any-nat option that allows to display src-NATted OR dst-NATted flows. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-29update error message for max netlink socket size reachedMohit Mehta
2010-06-28conntrack: fix port filter with `--src-nat' and `--dst-nat'Pablo Neira Ayuso
This patch allows the following command to filter port-based NAT: $ conntrack -L --dst-nat :9999 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-220.9.14-2+vyatta5debian/0.9.14-2+vyatta5Mohit Mehta
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-15 01:40:08 +0000