summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2011-02-18doc: document redundant link support for conntrackdPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-18doc: document -s option of conntrackd in the manualPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-18conntrackd: remove use of deprecated nfct_maxsize()Pablo Neira Ayuso
This patch removes the use of nfct_maxsize() and several abusive stack-based allocations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-17conntrack: allocate template objects in the heapPablo Neira Ayuso
With this patch, we don't abuse the stack anymore, instead we allocate the template objects that are used in the heap. We stop using nfct_maxsize() which is now deprecated in libnetfilter_conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-17conntrackd: use nfct_copy() with override flag in cache_object_new()Pablo Neira Ayuso
Using memcpy() is not safe, it breaks secctx and it may break more things in the future. Moreover, nfct_size*() functions will be deprecated soon, they are evil since they open the window to memcpy(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-17conntrack: add -o ktimestamp option (it requires linux >= 2.6.38)Pablo Neira Ayuso
This option requires Linux kernel >= 2.6.38, you have to enable conntrack timestamping with: echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp # conntrack -L -o ktimestamp udp 17 59 src=192.168.1.128 dst=192.168.1.1 sport=52050 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=52050 [ASSURED] mark=0 delta-time=121 [start=Thu Feb 17 17:41:18 2011] use=1 # conntrack -L conntrack v0.9.15 (conntrack-tools): 20 flow entries have been shown. udp 17 31 src=192.168.1.128 dst=192.168.1.1 sport=52050 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=52050 [ASSURED] mark=0 delta-time=149 use=1 # conntrack -E -o ktimestamp ... [DESTROY] udp 17 src=192.168.1.128 dst=192.168.1.1 sport=40162 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=40162 [ASSURED] delta-time=3 [start=Thu Feb 17 17:44:57 2011] [stop=Thu Feb 17 17:45:00 2011] # conntrack -E [DESTROY] udp 17 src=192.168.1.128 dst=77.226.252.14 sport=123 dport=123 src=77.226.252.14 dst=192.168.1.128 sport=123 dport=123 delta-time=8 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-16conntrackd: rise number of committed entries per stepPablo Neira Ayuso
This patch rises the number of committed entries per step from 64 to 8192. Experimental results in active-active setups here show that we reduce the commit time with this value significantly. This deserves some more study, it can be a good idea to remove this commit per step completely. I leave this for the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-16conntrackd: event iteration limiter is already reset in main select loopPablo Neira Ayuso
This patch removes an unnecessary reset of the event iteration limiter that is already done in the main select loop. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-15cache: log if we received a commit request while already one in progressPablo Neira Ayuso
This patch improves the case in which we receive a commit request but we are already performing one. This behaviour is suspicious since the HA manager should not trigger a double master transition. Otherwise, something probably is not configured appropriately. This improves 98756c2608f0879a2322919c7441973216565272 "cache: close commit request if we already have one in progress". Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-13cache: close commit request if we already have one in progressPablo Neira Ayuso
We close a commit request if there's already one in progress. This patch fixes a problem that may be triggered if two consecutive commit requests are received. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-13sync: don't override initial return value of local handlerPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-13local: don't override initial return valuePablo Neira Ayuso
The return initial value is overriden after the initial read. Don't override this value, instead we check the return value of the read() operation. This patch also changes the error statistics accounting since we consider that a request with no data is an error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-01doc: remove reference to the CT targetPablo Neira Ayuso
Sorry, the iptables CT target is not yet ready for use until some patches are pushed to the Linux kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-01-16doc: update conntrack-tools manualPablo Neira Ayuso
This update adds to the documentation the following information: * add reference to "Demystifying cluster-based fault-tolerant firewalls" * add how-to disable the external cache * add how-to disable the internal cache * add how-to set the synchronization transport protocol * document iptables CT target * ask for sponsors to finish H323 and SIP support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-11-05build: remove redundant bison/lex testsJan Engelhardt
AC_PROG_{LEX,YACC} already searches for the programs, so no need to do it again with AC_CHECK_PROGS. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-11-05build: use AM_YFLAGS instead of overriding YACCJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-11-05build: run autoupdate to replace obsolete constructsJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-11-05build: default to not building static librariesJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-11-05build: resolve automake warningJan Engelhardt
src/Makefile.am:24: whitespace following trailing backslash Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31Add .gitignore filesJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: no need for error message in PKG_CHECK_MODULESJan Engelhardt
PKG_CHECK_MODULES already produces its own (and more verbose) messsage when a module cannot be found. Mucking around with CFLAGS and LIBS is also not needed since pkgconfig takes care of providing variables, so let's use them in Makefile.am. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: remove unused $(all_libraries)Jan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: remove statements without effectJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: drop unused $(all_includes)Jan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: use modern call syntax for AM_INIT_AUTOMAKEJan Engelhardt
automake options also need to definitely go into configure.ac, otherwise they only apply to a single directory. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-31build: use autoconf-suggested naming of filesJan Engelhardt
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
2010-10-12conntrack: allow to listen to all kind of expectation eventsPablo Neira Ayuso
So far, conntrack only allows to listen to events of new expectations. With this patch, we can listen to events of destroyed expectations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-10-12conntrack: fix missing line break in conntrack(8) manpagePablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-08-04conntrackd: minor documentation update (two new questions in the FAQ)Pablo Neira Ayuso
This patch includes a minor documentation update with two new questions in the FAQ. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-08-04conntrackd: fix wrong kernel requirements for TCPWindowTracking in example filesPablo Neira Ayuso
This patch fixes wrong Linux kernel requirements in the example configuration files. We require a Linux kernel >= 2.6.36 instead of >= 2.6.35 as the files suggest. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-15build: bump version to 0.9.15conntrack-tools-0.9.15Pablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-15build: update libnetfilter_conntrack dependency (>= 0.0.102)Pablo Neira Ayuso
We require the latest libnetfilter_conntrack version to fix several bugs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-15conntrackd: warn on TCPWindowTracking option (it requires kernel >= 2.6.35)Pablo Neira Ayuso
This patch adds a comment on the TCPWindowTracking option to warn that this will be supported since the Linux kernel 2.6.35. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-13conntrackd: fix parsing of NAT sequence adjustment in synchronization messagesPablo Neira Ayuso
This patch fixes a bug that results in an incorrect parsing of the NAT sequence adjustment in synchronization messages. Spotted by Adam Gundy in the following message that was sent to the netfilter ML: http://marc.info/?l=netfilter&m=127894708222913&w=2 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-09conntrackd: replace cryptic `mfrm' by `malformed' in `-s'Mohit Mehta
Looking at the output of `conntrackd -s`; I didn't know what 'mfrm' meant under the 'message sequence tracking' section so I had to look up the code for this. While doing so, I replaced 'mfrm' with 'malformed' in the output since I thought other users might be confused as well as I was looking at that word. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-07conntrackd: setup event reliability after handler creationPablo Neira Ayuso
This patch enables the event reliability in an early stage of the event handler initialization. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-07conntrackd: open event handler once cache has been populatedPablo Neira Ayuso
With this patch, we open the event handler once the internal cache (if any) is populated. This reduces the chances of a possible premature overrun if we lauch conntrackd in a busy firewall. However, we may still start with an internal cache that may differ a bit from the once in the kernel. This patch has no impact in setups where conntrackd is started in a spare firewall. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-07conntrackd: enforce strict logic for NetlinkBufferSize[*] clausesMohit Mehta
- NetlinkBufferSize value passed to the kernel gets doubled [see SO_RCVBUF in net/core/sock.c]; it's halved now before it gets sent to the kernel. This ensures that daemon starts up with a netlink socket buffer size equal to the value set for NetlinkBufferSize in configuration file. - Previously, netlink socket buffer size would only stop increasing after it had increased beyond NetlinkBufferSizeMaxGrowth value. With this commit netlink socket buffer size increases as long as it is less than or equal to NetlinkBufferSizeMaxGrowth value. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-05conntrack: add zone supportPablo Neira Ayuso
This patch adds `--zone' to the command line tool. This adds the missing user-space support for Patrick's McHardy iptables CT target. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrackd: fix ICMPv6 supportPablo Neira Ayuso
This patch fixes several minor nitpicks to support IPv6 failover: * ICMPv6 type/code/id were missing in synchronization messages. * The use of '-' as string in the configuration file was not allowed. * Include example in configuration file under doc/. Reported-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrackd: update error message for max netlink socket size reachedMohit Mehta
It must refer to NetlinkBufferSize[*] instead of "SocketBufferSize[*]. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: cleanup parsing of the NAT argumentsPablo Neira Ayuso
This patch cleans up nat_parse() and it also displays nicer error message for malformed arguments. % conntrack -L --src-nat :80 conntrack v0.9.14 (conntrack-tools): No IP specified Try `conntrack -h' or 'conntrack --help' for more information. % conntrack -L --src-nat 1.1.1.1: conntrack v0.9.14 (conntrack-tools): No port specified after `:' Try `conntrack -h' or 'conntrack --help' for more information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --[src|dst|any]-nat IP:PORT' if port mismatchesPablo Neira Ayuso
This patch fixes the filtering if the IP matches an entry but the PORT does not matches. Without this patch, the entry is shown when it should be not. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: --[src|dst|any]-nat requires IP:PORT as argumentPablo Neira Ayuso
This patch restricts the behaviour that we previously introduced in 142606c60808b3ab0496155ac3d086765e6baef3. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --any-nat 1.1.1.1' filteringPablo Neira Ayuso
This patch adds the missing bits to allow to filter with --any-nat based on the IP address. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --src-nat 1.1.1.1' if PAT appliedPablo Neira Ayuso
This patch fixes another scenario in which the flow has some PAT mangling and we passed the src-nat address that we want to use to perform the filtering. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --src-nat 3.3.3.3' and similarPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix bogus NATted flows in filteringPablo Neira Ayuso
With this patch, conntrack does not show bogus entries that have no NAT applied due to a relaxed checking. conntrack -L --src-nat :80 tcp 6 342824 ESTABLISHED src=XX.214.188.80 dst=66.XX.7.180 sport=80 dport=13749 packets=4 bytes=6000 [UNREPLIED] src=66.XX.7.180 dst=XX.214.188.80 sport=13749 dport=80 packets=0 bytes=0 mark=0 secmark=0 use=1 conntrack v0.9.14 (conntrack-tools): 1 flow entries have been shown. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: re-fix inconsistent display with `--src-nat' and `--dst-nat'Pablo Neira Ayuso
In 142606c60808b3ab0496155ac3d086765e6baef3, I re-introduced the inconsistent behaviour that I described in 85f94171a71880c744f265268f33ad58819caa74. Great. This patch fixes this again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: add testsuite for NAT filtering optionsPablo Neira Ayuso
This patch adds the testsuite for the NAT filtering options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-01 01:55:34 +0000