summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2012-07-31fixing 8243: fix will selectively flush the conntrack table on master, ↵Gaurav Sinha
ignoring ignored addresses during flush
2012-07-061:1.0.1-2+vyatta33debian/1.0.1-2+vyatta33Gaurav Sinha
2012-07-06conntrackd: fix commit operation, needs to be synchronousPablo Neira Ayuso
While adding the expectation support for conntrackd, I accidentally broke synchrony in 'conntrackd -c' command. Basically, conntrackd -c should not return control to the shell until the cache has been committed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> (cherry picked from commit 7eb63b5872f07903d952aa5cfd6ad0e7647a066a) (cherry picked from commit 93d244a982f80a691bfb6eb4e17e2cccc32a5cb9)
2012-07-06conntrackd: add bugtrap notice in case of flush while commit in progressPablo Neira Ayuso
Flushing the external cache, ie. conntrackd -f, while commit is in progress is not allowed anymore, ie. conntrackd -c. Note that conntrackd -c is synchronous. Thus, it returns control to the caller once the commit has finished. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> (cherry picked from commit 8648ae6d08bb84030c2c3519454532f6e04e31d9) (cherry picked from commit 3611b5f5992837224205361c25cfed55c47af8c4)
2012-06-071:1.0.1-2+vyatta32debian/1.0.1-2+vyatta32Gaurav Sinha
2012-06-07Merge branch 'cthelper12' of git://git.netfilter.org/conntrack-tools into ↵Gaurav Sinha
pacifica Conflicts: include/helper.h src/expect.c src/helpers/ftp.c src/helpers/rpc.c src/helpers/tns.c tests/conntrackd/cthelper/main.c tests/conntrackd/cthelper/run-test.sh
2012-06-07tests: conntrackd: add cthelper-test infrastructurePablo Neira Ayuso
This patch adds the automated testing infrastructure the user-space helpers. Basically, this adds the `cthelper-test' program that can be invoked from the command line: ./cthelper-test pcaps/oracle-tns-redirect.pcap tns tcp 1521 To test the helper with one PCAP file that contains traces of Oracle TNS traffic. It also provides tweaks to test the DNAT content mangling code: ./cthelper-test pcaps/oracle-tns-redirect.pcap tns tcp 1521 dnat This will also allow fuzzy testing of user-space helper, for further validation, not yet implemented. To compile this tool, you have to run: ./configure make check under the qa/cthelper-test/ directory. I'm doing like this because this directory is not included in the standalone tarball that make distcheck generates (I don't want to bloat it with development tools that can be retrieved from the git repository). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-06-07conntrackd: TNS helper added to cthelperJozsef Kadlecsik
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-06-07conntrackd: RPC helper added to cthelperJozsef Kadlecsik
How to use this helper in a few steps: 1) You can enable this helper via: nfct helper add rpc inet tcp nfct helper add rpc inet udp 2) Configure /etc/conntrackd/conntrackd.conf and launch it. 3) You can test this helper locally with the following rule-set: iptables -A OUTPUT -t raw -p udp -m udp --dport 111 -j CT --helper rpc iptables -A OUTPUT -t raw -p tcp -m tcp --dport 111 -j CT --helper rpc iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 111 -j ACCEPT iptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -m udp --dport 111 -j ACCEPT iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -P OUTPUT DROP 4) Configure NFS and export some local directory. Then, mount it with version 3. mount.nfs -onfsvers=3 127.0.0.1:/srv/cvs /mnt/ You should see permanent expectations created for this. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-06-07conntrackd: add cthelper infrastructure (+ example FTP helper)Pablo Neira Ayuso
This patch adds the user-space helper infrastructure. It also contains the implementation of the FTP helper in user-space. There's one example file that you can use to configure conntrackd as user-space connection tracking helper under: doc/helper/conntrackd.conf Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-06-051:1.0.1-2+vyatta31debian/1.0.1-2+vyatta31Gaurav Sinha
2012-06-05Debian package conntrack-helpers to package helpers in user spaceGaurav Sinha
2012-06-041:1.0.1-2+vyatta30debian/1.0.1-2+vyatta30Gaurav Sinha
2012-06-04forced release:cttimeout refreshed on build machineGaurav Sinha
2012-06-041:1.0.1-2+vyatta29debian/1.0.1-2+vyatta29Gaurav Sinha
2012-06-04Add nfct debian package to this submodule.Gaurav Sinha
2012-06-011:1.0.1-2+vyatta28debian/1.0.1-2+vyatta28Gaurav Sinha
2012-06-01Merge branch 'cthelper10' of git://git.netfilter.org/conntrack-tools into ↵user_space_helpersGaurav Sinha
user_space_helpers Conflicts: src/cthelper.c src/helpers/ftp.c src/helpers/tns.c
2012-05-31tests: conntrackd: add cthelper-test infrastructurePablo Neira Ayuso
This patch adds the automated testing infrastructure the user-space helpers. Basically, this adds the `cthelper-test' program that can be invoked from the command line: ./cthelper-test oracle-tns/oracle-tns-redirect.pcap tns tcp To test the helper with one PCAP file that contains traces of Oracle TNS traffic. This will also allow fuzzy testing of user-space helper, for further validation, not yet implemented. To compile this tool, you have to run: ./configure make check under the qa/cthelper-test/ directory. I'm doing like this because this directory is not included in the standalone tarball that make distcheck generates (I don't want to bloat it with development tools that can be retrieved from the git repository). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-31conntrackd: TNS helper added to cthelperJozsef Kadlecsik
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-31conntrackd: RPC helper added to cthelperJozsef Kadlecsik
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-31conntrackd: add cthelper infrastructure (+ example FTP helper)Pablo Neira Ayuso
This patch adds the user-space helper infrastructure. It also contains the implementation of the FTP helper in user-space. There's one example file that you can use to configure conntrackd as user-space connection tracking helper under: doc/helper/conntrackd.conf Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-301:1.0.1-2+vyatta27debian/1.0.1-2+vyatta27Gaurav Sinha
2012-05-30forced releaseGaurav Sinha
2012-05-301:1.0.1-2+vyatta26debian/1.0.1-2+vyatta26Gaurav Sinha
2012-05-30forced releaseGaurav Sinha
2012-05-301:1.0.1-2+vyatta25debian/1.0.1-2+vyatta25Gaurav Sinha
2012-05-30force release:dependency fix on build machineGaurav Sinha
2012-05-301:1.0.1-2+vyatta24debian/1.0.1-2+vyatta24Gaurav Sinha
2012-05-30force release:post build dependency fix on build machineGaurav Sinha
2012-05-301:1.0.1-2+vyatta23debian/1.0.1-2+vyatta23Gaurav Sinha
2012-05-30Merge branch 'cthelper9' of git://git.netfilter.org/conntrack-tools into ↵Gaurav Sinha
user_space_helpers Conflicts: .gitignore src/run.c
2012-05-28tests: conntrackd: add cthelper-test infrastructurePablo Neira Ayuso
This patch adds the automated testing infrastructure the user-space helpers. Basically, this adds the `cthelper-test' program that can be invoked from the command line: ./cthelper-test oracle-tns/oracle-tns-redirect.pcap tns tcp To test the helper with one PCAP file that contains traces of Oracle TNS traffic. This will also allow fuzzy testing of user-space helper, for further validation, not yet implemented. To compile this tool, you have to run: ./configure make check under the qa/cthelper-test/ directory. I'm doing like this because this directory is not included in the standalone tarball that make distcheck generates (I don't want to bloat it with development tools that can be retrieved from the git repository). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-28conntrackd: TNS helper added to cthelperJozsef Kadlecsik
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-28conntrackd: RPC helper added to cthelperJozsef Kadlecsik
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-28conntrackd: add cthelper infrastructure (+ example FTP helper)Pablo Neira Ayuso
This patch adds the user-space helper infrastructure. It also contains the implementation of the FTP helper in user-space. There's one example file that you can use to configure conntrackd as user-space connection tracking helper under: doc/helper/conntrackd.conf Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-28conntrackd: move ctnetlink code to ctnl.c (removed from run.c)Pablo Neira Ayuso
This patch moves the specific ctnetlink code to ctnl.c to prepare the introduction of the cthelper infrastructure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-28conntrackd: generalize file descriptor infrastructurePablo Neira Ayuso
This patch generalizes the select-based file descriptor infrastructure by allowing you to register file descriptors and its callbacks. Instead of hardcoding the descriptors that needs to be checked. Now, struct fds_item contains a callback and pointer to data that is passed to it: struct fds_item { struct list_head head; int fd; + void (*cb)(void *data); + void *data; }; Then, we check which ones are active in the select_main_step() function: list_for_each_entry(cur, &STATE(fds)->list, head) { if (FD_ISSET(cur->fd, &readfds)) cur->cb(cur->data); } And it invoked the corresponding callback. I had to slightly modify the channel infrastructure to fit it into the changes. This modularity is required for the upcoming cthelper support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-28conntrackd: simplify TCP connection handling logicPablo Neira Ayuso
Before this patch, we called accept() to likely return EAGAIN. This is not required as select() will tell us that we're ready to accept. Therefore, that early accept() invocation complicates the whole handling just to get the connection accepted a bit before. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-26update .gitignoreJan Engelhardt
2012-05-26bump version to 1.2.1Pablo Neira Ayuso
this release fixes a compilation issue in 1.2.0, sorry. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-26nfct: fix compilation of timeout extensionPablo Neira Ayuso
nfct-extensions/timeout.c: In function ‘nfct_timeout_cb’: nfct-extensions/timeout.c:99:2: warning: passing argument 4 of ‘nfct_timeout_snprintf’ makes integer from pointer without a cast [enabled by default] /usr/include/libnetfilter_cttimeout/libnetfilter_cttimeout.h:114:5: note: expected ‘unsigned int’ but argument is of type ‘struct nfct_timeout *’ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-26add README.nfctPablo Neira Ayuso
This files includes some short description on `nfct'. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-26add nfct(8) manpagePablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-26tests: conntrack: add run-test.sh scriptPablo Neira Ayuso
For automated testing of the conntrack utility. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-26move qa directory to tests/conntrack/Pablo Neira Ayuso
All automated testing for the conntrack-tools will now reside under the test directory. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-26build: update dependencies with libnetfilter_conntrack (>= 1.0.1)Pablo Neira Ayuso
libnetfilter_conntrack 1.0.1 includes important updates for the expectation side, which is used in this major milestone release. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-26nfct: fix compilation warning in cttimeout supportPablo Neira Ayuso
CC nfct-extensions/timeout.o ../../src/nfct-extensions/timeout.c: In function ‘nfct_cmd_timeout_parse_params’: ../../src/nfct-extensions/timeout.c:40:27: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-26build: bump version to 1.2.0Pablo Neira Ayuso
Major milestone including the new `nfct' utility and the expectation support for conntrackd. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-05-26tests: add nfct tests for cttimeoutPablo Neira Ayuso
This patch adds the automated tests for the cttimeout infrastructure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-14 22:11:33 +0000