summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2010-07-01conntrack: fix `conntrack --any-nat 1.1.1.1' filteringPablo Neira Ayuso
This patch adds the missing bits to allow to filter with --any-nat based on the IP address. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --src-nat 1.1.1.1' if PAT appliedPablo Neira Ayuso
This patch fixes another scenario in which the flow has some PAT mangling and we passed the src-nat address that we want to use to perform the filtering. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --src-nat 3.3.3.3' and similarPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix bogus NATted flows in filteringPablo Neira Ayuso
With this patch, conntrack does not show bogus entries that have no NAT applied due to a relaxed checking. conntrack -L --src-nat :80 tcp 6 342824 ESTABLISHED src=XX.214.188.80 dst=66.XX.7.180 sport=80 dport=13749 packets=4 bytes=6000 [UNREPLIED] src=66.XX.7.180 dst=XX.214.188.80 sport=13749 dport=80 packets=0 bytes=0 mark=0 secmark=0 use=1 conntrack v0.9.14 (conntrack-tools): 1 flow entries have been shown. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: re-fix inconsistent display with `--src-nat' and `--dst-nat'Pablo Neira Ayuso
In 142606c60808b3ab0496155ac3d086765e6baef3, I re-introduced the inconsistent behaviour that I described in 85f94171a71880c744f265268f33ad58819caa74. Great. This patch fixes this again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: add testsuite for NAT filtering optionsPablo Neira Ayuso
This patch adds the testsuite for the NAT filtering options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: add `--any-nat' to filter any NATted flowPablo Neira Ayuso
This patch adds the --any-nat option that allows to display src-NATted OR dst-NATted flows. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-29update error message for max netlink socket size reachedMohit Mehta
2010-06-28conntrack: fix port filter with `--src-nat' and `--dst-nat'Pablo Neira Ayuso
This patch allows the following command to filter port-based NAT: $ conntrack -L --dst-nat :9999 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-220.9.14-2+vyatta5debian/0.9.14-2+vyatta5Mohit Mehta
2010-06-22update dh_gencontrol for dev buildMohit Mehta
2010-06-22conntrack: put all the commands and options code togetherPablo Neira Ayuso
This patch is a cleanup, it puts all the commands and options code together. This makes easier and less error-prone the task to add new commands and options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-22conntrack: expand array that maps option-flags to option-namesPablo Neira Ayuso
This patch is a cleanup, it expands an array that contains the correspondence between the option-flags and the option-names. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-17conntrack: fix `conntrack -L -n -g` filter using AND, not OR logicPablo Neira Ayuso
2010-06-17conntrack: fix `conntrack -L -n -g` (second try)Pablo Neira Ayuso
2010-06-17Revert "fix `conntrack -L --src-nat --dst-nat`"Mohit Mehta
This reverts commit b4d4591734726a7b38a579acf272022caf5a0534.
2010-06-17conntrackd: complete TCP window scale supportPablo Neira Ayuso
In commit 56817d1c0cc30bcd65c56c2f73634b256603cc4d, I added the TCP window scale factor support but it was incomplete. We have to set the IP_CT_TCP_FLAG_WINDOW_SCALE flag to update the td_scale field via ctnetlink. Check nlattr_to_tcp(...) function in nf_conntrack_proto_tcp.c for more details. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-17conntrack: `-L --src-nat --dst-nat' filter using AND, not OR logicPablo Neira Ayuso
The patch that I committed in 2e06d62d341fdf936dbc1fa944d5e03f761aaf0e was incomplete. With it, `-L --src-nat --dst-nat' shows source-natted OR destination-natted flows. This patch changes the behaviour to show source-natted AND destination-natted flows. This is the consistent behaviour that we expect from conntrack (this is how it works for other options indeed). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-17conntrack: fix `conntrack -L --src-nat --dst-nat' (second try)Pablo Neira Ayuso
This patch fixes the filtering with --src-nat and --dst-nat options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-17conntrack: revert fix `-L --src-nat --dst-nat'Pablo Neira Ayuso
This patch reverts 0865d22af0ec5876f721d44c90ac898fdfa435aa since it breaks conntrack listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-150.9.14-2+vyatta4debian/0.9.14-2+vyatta4Mohit Mehta
2010-06-15This patch move the ports addition to the layer 4 functions, insteadPablo Neira Ayuso
of checking for the port attribute. It also adds a function for UDP otherwise we break support for this protocol.
2010-06-15fix `conntrackd -i -x`Mohit Mehta
2010-06-15fix `conntrack -L --src-nat --dst-nat`Pablo Neira Ayuso
2010-06-140.9.14-2+vyatta3debian/0.9.14-2+vyatta3Mohit Mehta
2010-06-14remove files for applied patchMohit Mehta
2010-06-14remove generated files, apply debian patch 10-fix_udp_support.dpatchMohit Mehta
2010-06-14update .gitignoreMohit Mehta
2010-06-14add missing m4 filesMohit Mehta
2010-06-15conntrackd: `-i -x' does not display internal cache in XMLMohit Mehta
`conntrackd -i -x' does not display internal cache in XML, this patch fixes the problem. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-140.9.14-2+vyatta2debian/0.9.14-2+vyatta2Mohit Mehta
2010-06-14add vyatta entry to changelogdebian/0.9.14-2+vyatta1root
2010-06-14debian conntrack 0.9.14-2root
2010-06-10conntrack: fix `-L --src-nat --dst-nat'Pablo Neira Ayuso
Since > 0.9.6, the conntrack listing with the options --src-nat and --dst-nat does not work. This patch fixes the problem. Reported-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-05-10doc: description on how to block traffic with conntrack was incompletePablo Neira Ayuso
This patch completes the documentation with the following discussion that took place in the mailing list. http://marc.info/?l=netfilter&m=127335152521674&w=2 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-02-28conntrackd: split __run() routine for poll and event-driven modesPablo Neira Ayuso
This patch splits the __run() routine into two functions, run_polling() and run_events() that are selected once in run-time. We save one branch in a loop that intensively executed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-02-28conntrackd: PollSecs goes in the General clause for statisticsPablo Neira Ayuso
This patch fixes the configuration file that includes an example of the PollSecs clause in Stats. This is wrong since it should go in the General clause. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-02-26conntrack: option `-t' in on the same line as `-m' in manpagePablo Neira Ayuso
From Richard Lucassen: > Btw: if you search the "-m --mask" option in the manpage, you'll see a > cosmetic typo: this option is on the same line as "-t --timeout" Reported-by: Richard Lucassen <reply5@xaq.nl> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-02-17conntrackd: fix `conntrackd -c' if external cache is disabledPablo Neira Ayuso
This patch fixes a hung that occurs if you invoke `conntrackd -c' and you have disabled the external cache. Note that `conntrackd -c' does nothing since there is no entries in the external cache to be committed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-02-16conntrackd: cleanup port addition in the message building pathPablo Neira Ayuso
This patch move the ports addition to the layer 4 functions, instead of checking for the port attribute. It also add a function for UDP otherwise we break support for this protocol. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-02-11conntrackd: add support for TCP window scale factor synchronizationPablo Neira Ayuso
This patch adds a new option TCPWindowTracking that allows not to disable TCP window tracking as it occurs by default. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-02-11conntrackd: fix UDP filtering in configuration filePablo Neira Ayuso
UDP filtering was broken during the addition of the UDP-based synchronization protocol that was introduced in 0.9.14. This patch fixes the problem. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-12-28build: bump version to 0.9.14conntrack-tools-0.9.14Pablo Neira Ayuso
This patch bumps conntrack-tools version to 0.9.14. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-12-24conntrackd: document `-B' commandPablo Neira Ayuso
This patch documents the `-B' command in conntrackd that allows you to force a bulk send to other firewall nodes in the cluster. Reported-by: Tino Keitel <tkeitel@innominate.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-12-23conntrack: fix manually created TCP entries with window tracking enabledPablo Neira Ayuso
With this patch, we allow to manually create TCP entries in the table. Basically, we disable TCP window tracking for this entry to avoid problems. Reported-by: Roman Fiedler <roman.fiedler@ait.ac.at> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-12-23conntrackd: document internal cache disabling and TCP-based synchronizationPablo Neira Ayuso
This patch documents the internal cache disabling feature that is available for the NOTRACK mode. I have also added an example on how to set up a TCP-based state-synchronization. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-12-23conntrackd: fix flow-state filtering for TCPPablo Neira Ayuso
This patch fixes the clause `State' in `Filter' that allows you to filter by protocol state. This bug was introduced during the implementation of the TCP-based synchronization. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-12-19conntrackd: add ICMP support for state-synchronizationPablo Neira Ayuso
This patch adds state-synchronization for ICMP. You SHOULD use a Linux kernel >= 2.6.31, otherwise this patch can result in tons of state-updates. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-12-19conntrackd: use indirect call to build layer 4 protocol informationPablo Neira Ayuso
With this patch, we use an indirect call to build the layer 4 information into the synchronization message. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-10-21conntrackd: add `DisableInternalCache' clausePablo Neira Ayuso
This patch adds the clause `DisableInternalCache' that allows you to bypass the internal cache. This clause can only be used with the notrack synchronization mode. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-15 02:33:07 +0000