summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-11-251:1.4.1-1+vyos2+lithium11debian/1.4.1-1+vyos2+lithium11Alex Harpin
2015-11-24conntrack-tools: bump build requirements for 1.4.1Alex Harpin
Bump the build requirements of conntrack-tools 1.4.1 to the versions needed for a build.
2015-11-24Merge tag 'conntrack-tools-1.4.1' into lithiumAlex Harpin
conntrack-tools 1.4.1 release
2015-11-241:1.4.0-1+vyos2+lithium10debian/1.4.0-1+vyos2+lithium10Alex Harpin
2015-11-24conntrack-tools: bump build requirements to actual levelAlex Harpin
Bump the build requirements of conntrack-tools 1.4.0 to the actual level needed for a build.
2015-11-221:1.4.0-1+vyos2+lithium9debian/1.4.0-1+vyos2+lithium9Alex Harpin
2015-11-22Update debian packagingAlex Harpin
2015-11-211:1.4.0-1+vyos2+lithium8Alex Harpin
2015-11-21Merge tag 'conntrack-tools-1.4.0' into lithiumAlex Harpin
conntrack-tools 1.4.0 release
2015-10-111:1.2.1-1+vyos2+lithium7debian/1.2.1-1+vyos2+lithium7Alex Harpin
2015-10-021:1.0.1-3+vyos2+lithium6debian/1.0.1-3+vyos2+lithium6Alex Harpin
2015-10-02conntrackd: build: fix crash when optional kernel modules are not loadedPablo Neira Ayuso
Fix a possible crash if conntrackd sees DCCP, SCTP and ICMPv6 traffic and the corresponding kernel modules that track this traffic are not available. Fixes: http://bugzilla.netfilter.org/show_bug.cgi?id=910 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2015-06-141:1.0.1-3+vyos2+lithium5debian/1.0.1-3+vyos2+lithium5Alex Harpin
2015-06-14conntrack: update dh_gencontrol with new development build flagAlex Harpin
2014-12-231:1.0.1-3+vyos2+lithium4debian/1.0.1-3+vyos2+lithium4Alex Harpin
2014-12-23Update maintainer addressAlex Harpin
2014-12-13Force releaseAlex Harpin
2014-12-131:1.0.1-3+vyos2+lithium3debian/1.0.1-3+vyos2+lithium3Alex Harpin
2014-10-251:1.0.1-3+vyos2+lithium2debian/1.0.1-3+vyos2+lithium2Daniil Baturin
2014-10-25Force releaseDaniil Baturin
2014-01-091:1.0.1-3+vyos1+helium4vyos/1.1.0-beta1debian/1.0.1-3+vyos1+helium4heliumDaniil Baturin
2014-01-09Fix version formatDaniil Baturin
2014-01-081:1.0.1-3+vyos+helium2debian/1.0.1-3+vyos+helium2Daniil Baturin
2014-01-081:1.0.1-3+vyos+helium1Daniil Baturin
2014-01-08New branchDaniil Baturin
2013-11-161:1.0.1-2+vyatta35+hydrogen1debian/1.0.1-2+vyatta35+hydrogen1Daniil Baturin
2013-11-16New branchDaniil Baturin
2013-03-03build: bump version to 1.4.1Pablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-12-141:1.0.1-2+vyatta35+daisy4vyatta/VC6.6R1/i386vyatta/VC6.6R1/amd64debian/1.0.1-2+vyatta35+daisy4daisyGaurav Sinha
2012-12-14force release: build failed due to race with libnetfilter-conntrack buildGaurav Sinha
2012-12-131:1.0.1-2+vyatta35+daisy3debian/1.0.1-2+vyatta35+daisy3Gaurav Sinha
2012-12-13patch to allow tracking dying and unconfirmed lists in conntrack to detect leaksGaurav Sinha
From patchwork Thu Nov 29 13:52:20 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: conntrack: add support to dump the dying and unconfirmed list via ctnetlink Date: Thu, 29 Nov 2012 03:52:20 -0000 From: Pablo Neira <pablo@netfilter.org> X-Patchwork-Id: 202751 Message-Id: <1354197140-8498-1-git-send-email-pablo@netfilter.org> To: netfilter-devel@vger.kernel.org From: Pablo Neira Ayuso <pablo@netfilter.org> This patch adds support for: conntrack -L dying conntrack -L unconfirmed To display the list of dying and unconfirmed conntracks. This provides some instrumentation in case that `conntrack -C` really deviates from what `conntrack -L | wc -l` says. Users like to check this to make sure things are going OK. Still, some conntrack objects may be still in the dying and the unconfirmed list. With this patch, we can also dump their content, before it was not possible. In normal cases both lists would be simply empty, or in the case of the dying list, you can observe that entries go slightly down in number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- src/conntrack.c | 108 ++++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 95 insertions(+), 13 deletions(-) Index: conntrack-tools-oxnard-2d010c5/src/conntrack.c =================================================================== --- conntrack-tools-oxnard-2d010c5.orig/src/conntrack.c 2012-11-30 22:02:18.356340288 +0100 +++ conntrack-tools-oxnard-2d010c5/src/conntrack.c 2012-11-30 22:02:31.011558172 +0100 @@ -820,27 +820,45 @@ *cmd |= newcmd; } -static unsigned int -check_type(int argc, char *argv[]) +static char *get_table(int argc, char *argv[]) { char *table = NULL; - /* Nasty bug or feature in getopt_long ? + /* Nasty bug or feature in getopt_long ? * It seems that it behaves badly with optional arguments. * Fortunately, I just stole the fix from iptables ;) */ if (optarg) return 0; - else if (optind < argc && argv[optind][0] != '-' - && argv[optind][0] != '!') + else if (optind < argc && argv[optind][0] != '-' && + argv[optind][0] != '!') table = argv[optind++]; - - if (!table) - return 0; - + + return table; +} + +enum { + CT_TABLE_CONNTRACK, + CT_TABLE_EXPECT, + CT_TABLE_DYING, + CT_TABLE_UNCONFIRMED, +}; + +static unsigned int check_type(int argc, char *argv[]) +{ + const char *table = get_table(argc, argv); + + /* default to conntrack subsystem if nothing has been specified. */ + if (table == NULL) + return CT_TABLE_CONNTRACK; + if (strncmp("expect", table, strlen(table)) == 0) - return 1; + return CT_TABLE_EXPECT; else if (strncmp("conntrack", table, strlen(table)) == 0) - return 0; + return CT_TABLE_CONNTRACK; + else if (strncmp("dying", table, strlen(table)) == 0) + return CT_TABLE_DYING; + else if (strncmp("unconfirmed", table, strlen(table)) == 0) + return CT_TABLE_UNCONFIRMED; else exit_error(PARAMETER_PROBLEM, "unknown type `%s'", table); @@ -1633,6 +1651,27 @@ return MNL_CB_OK; } +static int mnl_nfct_dump_cb(const struct nlmsghdr *nlh, void *data) +{ + struct nf_conntrack *ct; + char buf[4096]; + + ct = nfct_new(); + if (ct == NULL) + return MNL_CB_OK; + + nfct_nlmsg_parse(nlh, ct); + + nfct_snprintf(buf, sizeof(buf), ct, NFCT_T_UNKNOWN, NFCT_O_DEFAULT, 0); + printf("%s\n", buf); + + nfct_destroy(ct); + + counter++; + + return MNL_CB_OK; +} + static struct ctproto_handler *h; int main(int argc, char *argv[]) @@ -1667,6 +1706,16 @@ switch(c) { /* commands */ case 'L': + type = check_type(argc, argv); + /* Special case: dumping dying and unconfirmed list + * are handled like normal conntrack dumps. + */ + if (type == CT_TABLE_DYING || + type == CT_TABLE_UNCONFIRMED) + add_command(&command, cmd2type[c][0]); + else + add_command(&command, cmd2type[c][type]); + break; case 'I': case 'D': case 'G': @@ -1677,14 +1726,25 @@ case 'C': case 'S': type = check_type(argc, argv); + if (type == CT_TABLE_DYING || + type == CT_TABLE_UNCONFIRMED) { + exit_error(PARAMETER_PROBLEM, + "Can't do that command with " + "tables `dying' and `unconfirmed'"); + } add_command(&command, cmd2type[c][type]); break; case 'U': type = check_type(argc, argv); - if (type == 0) + if (type == CT_TABLE_DYING || + type == CT_TABLE_UNCONFIRMED) { + exit_error(PARAMETER_PROBLEM, + "Can't do that command with " + "tables `dying' and `unconfirmed'"); + } else if (type == CT_TABLE_CONNTRACK) add_command(&command, CT_UPDATE); else - exit_error(PARAMETER_PROBLEM, + exit_error(PARAMETER_PROBLEM, "Can't update expectations"); break; /* options */ @@ -1884,6 +1944,28 @@ struct nfct_filter_dump *filter_dump; case CT_LIST: + if (type == CT_TABLE_DYING) { + if (nfct_mnl_socket_open() < 0) + exit_error(OTHER_PROBLEM, "Can't open handler"); + + res = nfct_mnl_dump(NFNL_SUBSYS_CTNETLINK, + IPCTNL_MSG_CT_GET_DYING, + mnl_nfct_dump_cb); + + nfct_mnl_socket_close(); + break; + } else if (type == CT_TABLE_UNCONFIRMED) { + if (nfct_mnl_socket_open() < 0) + exit_error(OTHER_PROBLEM, "Can't open handler"); + + res = nfct_mnl_dump(NFNL_SUBSYS_CTNETLINK, + IPCTNL_MSG_CT_GET_UNCONFIRMED, + mnl_nfct_dump_cb); + + nfct_mnl_socket_close(); + break; + } + cth = nfct_open(CONNTRACK, 0); if (!cth) exit_error(OTHER_PROBLEM, "Can't open handler"); (cherry picked from commit 2cd070dbd7966af448ef38b245bb59c002bbcedb) Conflicts: debian/changelog
2012-12-04conntrack: add support to dump the dying and unconfirmed list via ctnetlinkPablo Neira Ayuso
This patch adds support for: conntrack -L dying conntrack -L unconfirmed To display the list of dying and unconfirmed conntracks. This provides some instrumentation in case that `conntrack -C` really deviates from what `conntrack -L | wc -l` says. Users like to check this to make sure things are going OK. Still, some conntrack objects may be still in the dying and the unconfirmed list. With this patch, we can also dump their content, before it was not possible. In normal cases both lists would be simply empty, or in the case of the dying list, you can observe that entries go slightly down in number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-11-06conntrackd: fix deadlock due to wrong nested signal blockingPablo Neira Ayuso
The existing code may nest several signal blocking and unblocking calls in different paths of the code. This may result in deadlocks while receiving signals. This patch simplifies the signal blocking approach. Now signals are blocked in three paths: 1) Internal timers handling, while running timer callback for expired timers. 2) File descriptor handling, while running file descriptor callbacks. 3) While handling signals, to avoid that SIGINT and SIGTERM in a row results in a deadlock. Thanks a lot to Ulrich Weber <ulrich.weber@sophos.com> for discussing a fix for this problem. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-10-131:1.0.1-2+vyatta35+daisy2debian/1.0.1-2+vyatta35+daisy2John Southworth
2012-10-131:1.0.1-2+vyatta35+daisy1John Southworth
2012-10-13create daisy branchJohn Southworth
2012-10-08bump version to 1.4.0 and update dependenciesPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-10-08doc: detail user-space helper supportPablo Neira Ayuso
This patch adds documentation on how to enable user-space helper support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-10-04conntrackd: fix crash if ExpectationSync is enabled on old Linux kernelsPablo Neira Ayuso
ExpectationSync requires Linux kernel >= 3.5 to work sanely, document this. Still, we don't want to crash if someone enables expectation sync with old Linux kernels (like 2.6.32). Reported-by: James Gutholm <gutholmj@evergreen.edu> Tested-by: James Gutholm <gutholmj@evergreen.edu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-09-21build: fix libraries dependencies in MakefilesNicolas Dichtel
Several includes are missing when netfilter libs are not in the standard path. Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-09-121:1.0.1-2+vyatta35vyatta/VC6.5R1/i386vyatta/VC6.5R1/amd64debian/1.0.1-2+vyatta35Gaurav Sinha
2012-09-12conntrackd: parse: fix wrong maximum length for ATTR_EXP_FNPablo Neira Ayuso
It was set to NFCT_HELPER_NAME_MAX (16 bytes), but we have function names that are larger, eg. nf-nat-follow-master which is 18 bytes long. This leads to hitting malformed message while synchronizing expectations. I'll add some new constant to libnetfilter_conntrack instead of hardcoding this, later. Reported-by: Gaurav Sinha <gaurav.sinha@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> (cherry picked from commit 46faeab56cf4117f41cb6f1f1c40a9c18a81372f) (cherry picked from commit 0cf70ce9b1bcb63d54d9514558b74ae2bde39d9f)
2012-09-10conntrackd: cthelper: add QueueLen optionPablo Neira Ayuso
This patch adds the QueueLen option, that allows you to increase the maximum number of packets waiting in the nfnetlink_queue to receive a verdict from userspace. Rising the default value (1024) is useful to avoid hitting the following error message: "nf_queue: full at X entries, dropping packets(s)". Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-09-08conntrackd: parse: fix wrong maximum length for ATTR_EXP_FNPablo Neira Ayuso
It was set to NFCT_HELPER_NAME_MAX (16 bytes), but we have function names that are larger, eg. nf-nat-follow-master which is 18 bytes long. This leads to hitting malformed message while synchronizing expectations. I'll add some new constant to libnetfilter_conntrack instead of hardcoding this, later. Reported-by: Gaurav Sinha <gaurav.sinha@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-08-24tests: conntrackd: fix compile errors and warningsAnsis Atteka
This patch fixes few compile warnings and errors. Signed-off-by: Ansis Atteka <aatteka@nicira.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-08-21cthelper: ftp: fix EPRT case for IPv4Pablo Neira Ayuso
%pI4 also exists in the Linux kernel. It would be good to have some generic functions to convert binary data to address string. Later. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-08-21cthelper: disable debugging information by defaultPablo Neira Ayuso
The pr_debug call should be converted to use dlog instead. I'll try to add some some configuration parameter to enable/disable debugging in runtime. This is not very flexible. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-08-03conntrackd: don't resync expectations if such sync has been disabledVincent Bernat
conntrackd was segfaulting with `ExpectationSync` set to `Off` and PollSecs (polling mode) in use. Signed-off-by: Vincent Bernat <bernat@luffy.cx> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-08-01nfct: helper: use CONNTRACKD_LIB_DIR variable set during configurationPablo Neira Ayuso
Instead of hardcoded path to /usr/lib/conntrack-tools/ which might not be true if options like --prefix with different location is passed to conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-22 03:12:23 +0000