summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2011-06-22conntrack: remove unused variable with -SPablo Neira Ayuso
Error: UNUSED_VALUE: conntrack-tools-1.0.0/src/conntrack.c:1297: returned_pointer: Pointer "nl" returned by "strchr(buf, 10)" is never used. Reported-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-06-15conntrack: skip sending update message to kernel if conntrack is unchangedFlorian Westphal
This speeds up operation when a lot of conntracks exist, but only a few of them have to be altered. This change is user-visible because the exit message ("%d flow entries have been updated") will now print the number of entries that have been altered instead of the total number of conntracks seen. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-06-15conntrack: add support for mark maskFlorian Westphal
Extend --mark option to optionally take a mask, seperated by '/', e.g. --mark 0x80/0xf0. When used with -L, only test those bits of the mark that are in the mask range (behaves like iptables like -m mark). When used with -U, zero out those bits indicated by the mask and XOR the new mark into the result (behaves like iptables -j MARK --set-xmark). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-03-15build: Linux kernel-style for compilation messagesPablo Neira Ayuso
[...] CC external_inject.o CC internal_cache.o CC internal_bypass.o CC read_config_yy.o CC read_config_lex.o CCLD conntrackd Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-27build: bump version to 1.0.0conntrack-tools-1.0.0Pablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-27doc: prepare 1.0.0 release in conntrack-tools manualPablo Neira Ayuso
Remove reference which states that this is still under development and refer to version 1.0.0. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-24build: conntrack-tools now requires libnetfilter_conntrack >= 0.9.1Pablo Neira Ayuso
The existing code requires new features that went into the current library version. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-22doc: add missing conntrackd -s invocation with optionsPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-22doc: add reference to the CT target againPablo Neira Ayuso
Now that we have fixed several aspects of the event filtering in 2.6.38, I reintroduce the documentation for this feature. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-22conntrack: support SYN_SENT2 TCP state as --state parameterPablo Neira Ayuso
Since Linux kernel 2.6.31, the LISTEN state is SYN_SENT2. With this patch, we allow to use -p tcp --state SYN_SENT2 which was not possible so far. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-22conntrack: display informative message if expectation table is flushedPablo Neira Ayuso
With this patch, we display the following message after: # conntrack -F expect conntrack v0.9.15 (conntrack-tools): expectation table has been emptied. To make it consistent with the message displayed with conntrack -F. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-18doc: document redundant link support for conntrackdPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-18doc: document -s option of conntrackd in the manualPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-18conntrackd: remove use of deprecated nfct_maxsize()Pablo Neira Ayuso
This patch removes the use of nfct_maxsize() and several abusive stack-based allocations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-17conntrack: allocate template objects in the heapPablo Neira Ayuso
With this patch, we don't abuse the stack anymore, instead we allocate the template objects that are used in the heap. We stop using nfct_maxsize() which is now deprecated in libnetfilter_conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-17conntrackd: use nfct_copy() with override flag in cache_object_new()Pablo Neira Ayuso
Using memcpy() is not safe, it breaks secctx and it may break more things in the future. Moreover, nfct_size*() functions will be deprecated soon, they are evil since they open the window to memcpy(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-17conntrack: add -o ktimestamp option (it requires linux >= 2.6.38)Pablo Neira Ayuso
This option requires Linux kernel >= 2.6.38, you have to enable conntrack timestamping with: echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp # conntrack -L -o ktimestamp udp 17 59 src=192.168.1.128 dst=192.168.1.1 sport=52050 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=52050 [ASSURED] mark=0 delta-time=121 [start=Thu Feb 17 17:41:18 2011] use=1 # conntrack -L conntrack v0.9.15 (conntrack-tools): 20 flow entries have been shown. udp 17 31 src=192.168.1.128 dst=192.168.1.1 sport=52050 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=52050 [ASSURED] mark=0 delta-time=149 use=1 # conntrack -E -o ktimestamp ... [DESTROY] udp 17 src=192.168.1.128 dst=192.168.1.1 sport=40162 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=40162 [ASSURED] delta-time=3 [start=Thu Feb 17 17:44:57 2011] [stop=Thu Feb 17 17:45:00 2011] # conntrack -E [DESTROY] udp 17 src=192.168.1.128 dst=77.226.252.14 sport=123 dport=123 src=77.226.252.14 dst=192.168.1.128 sport=123 dport=123 delta-time=8 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-16conntrackd: rise number of committed entries per stepPablo Neira Ayuso
This patch rises the number of committed entries per step from 64 to 8192. Experimental results in active-active setups here show that we reduce the commit time with this value significantly. This deserves some more study, it can be a good idea to remove this commit per step completely. I leave this for the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-16conntrackd: event iteration limiter is already reset in main select loopPablo Neira Ayuso
This patch removes an unnecessary reset of the event iteration limiter that is already done in the main select loop. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-15cache: log if we received a commit request while already one in progressPablo Neira Ayuso
This patch improves the case in which we receive a commit request but we are already performing one. This behaviour is suspicious since the HA manager should not trigger a double master transition. Otherwise, something probably is not configured appropriately. This improves 98756c2608f0879a2322919c7441973216565272 "cache: close commit request if we already have one in progress". Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-13cache: close commit request if we already have one in progressPablo Neira Ayuso
We close a commit request if there's already one in progress. This patch fixes a problem that may be triggered if two consecutive commit requests are received. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-13sync: don't override initial return value of local handlerPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-13local: don't override initial return valuePablo Neira Ayuso
The return initial value is overriden after the initial read. Don't override this value, instead we check the return value of the read() operation. This patch also changes the error statistics accounting since we consider that a request with no data is an error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-01doc: remove reference to the CT targetPablo Neira Ayuso
Sorry, the iptables CT target is not yet ready for use until some patches are pushed to the Linux kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-01-16doc: update conntrack-tools manualPablo Neira Ayuso
This update adds to the documentation the following information: * add reference to "Demystifying cluster-based fault-tolerant firewalls" * add how-to disable the external cache * add how-to disable the internal cache * add how-to set the synchronization transport protocol * document iptables CT target * ask for sponsors to finish H323 and SIP support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-12-280.9.14-2+vyatta12debian/0.9.14-2+vyatta12An-Cheng Huang
2010-12-28new branchAn-Cheng Huang
2010-11-05build: remove redundant bison/lex testsJan Engelhardt
AC_PROG_{LEX,YACC} already searches for the programs, so no need to do it again with AC_CHECK_PROGS. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-11-05build: use AM_YFLAGS instead of overriding YACCJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-11-05build: run autoupdate to replace obsolete constructsJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-11-05build: default to not building static librariesJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-11-05build: resolve automake warningJan Engelhardt
src/Makefile.am:24: whitespace following trailing backslash Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31Add .gitignore filesJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: no need for error message in PKG_CHECK_MODULESJan Engelhardt
PKG_CHECK_MODULES already produces its own (and more verbose) messsage when a module cannot be found. Mucking around with CFLAGS and LIBS is also not needed since pkgconfig takes care of providing variables, so let's use them in Makefile.am. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: remove unused $(all_libraries)Jan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: remove statements without effectJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: drop unused $(all_includes)Jan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: use modern call syntax for AM_INIT_AUTOMAKEJan Engelhardt
automake options also need to definitely go into configure.ac, otherwise they only apply to a single directory. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: use autoconf-suggested naming of filesJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-12conntrack: allow to listen to all kind of expectation eventsPablo Neira Ayuso
So far, conntrack only allows to listen to events of new expectations. With this patch, we can listen to events of destroyed expectations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-10-12conntrack: fix missing line break in conntrack(8) manpagePablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-09-020.9.14-2+vyatta11debian/0.9.14-2+vyatta11An-Cheng Huang
2010-08-310.9.14-2+vyatta10debian/0.9.14-2+vyatta10An-Cheng Huang
2010-08-31remove debian patching from buildAn-Cheng Huang
2010-08-04conntrackd: minor documentation update (two new questions in the FAQ)Pablo Neira Ayuso
This patch includes a minor documentation update with two new questions in the FAQ. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-08-04conntrackd: fix wrong kernel requirements for TCPWindowTracking in example filesPablo Neira Ayuso
This patch fixes wrong Linux kernel requirements in the example configuration files. We require a Linux kernel >= 2.6.36 instead of >= 2.6.35 as the files suggest. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-220.9.14-2+vyatta9debian/0.9.14-2+vyatta9An-Cheng Huang
2010-07-15build: bump version to 0.9.15conntrack-tools-0.9.15Pablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-15build: update libnetfilter_conntrack dependency (>= 0.0.102)Pablo Neira Ayuso
We require the latest libnetfilter_conntrack version to fix several bugs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-15conntrackd: warn on TCPWindowTracking option (it requires kernel >= 2.6.35)Pablo Neira Ayuso
This patch adds a comment on the TCPWindowTracking option to warn that this will be supported since the Linux kernel 2.6.35. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-14 22:52:17 +0000