summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-10-15conntrackd: Don't hardcode libs dir pathHani Benhabiles
Use CONNTRACKD_LIB_DIR instead of hardcoded path. Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-11nfct: Fix use-after-free / double-freeHani Benhabiles
helper's list and flush commands handlers shouldn't call mnl_socket_close on the passed netlink socket as it is done in the main function after parse_params call. Bug introduced in (3c78a45 nfct: src: consolidate netlink socket creation). Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-07conntrackd: cthelper: add amanda helperPablo Neira Ayuso
This patch adds a userspace port of the amanda helper that is currently implemented in the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
2013-10-03conntrackd: cthelper: add TFTP helperPablo Neira Ayuso
This patch adds an userspace port of the TFTP helper that is currently implemented in the kernel. This includes NAT support. It requires a Linux kernel 3.12. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-03conntrackd: cthelper: add SANE helperPablo Neira Ayuso
This patch adds an userspace port of the SANE helper that is currently implemented in the kernel. This requires Linux kernel 3.12 to work.
2013-10-01nfct: src: consolidate netlink socket creationPablo Neira Ayuso
Open the socket from the main function, then pass it as parameter to the corresponding interpreter. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-10-01nfct: src: add nfct_mnl_talk and use itPablo Neira Ayuso
Add helper function nfct_mnl_talk and use it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-09-30nfct: timeout: split nfct_cmd_timeout_add in several functionsPablo Neira Ayuso
This patch is a cleanup to split this function in smaller chunks. It is required to prepare default protocol timeout tuning via netlink.
2013-09-30nfct: timeout: use getprotoentPablo Neira Ayuso
The kernel bails out for unsupported protocols. Moreover, we don't need to upgrade to support new protocols. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-09-26build: add --disable-cthelper and --disable-cttimeoutPablo Neira Ayuso
This patch allows you to disable userspace helper support and conntrack timeout tuning at build stage. By default, both features are enabled, to avoid breaking backward compatibility. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-09-26nfct: modularize extensionsPablo Neira Ayuso
Modularize timeout and helper extensions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-09-26conntrackd: helpers: add DHCPv6 helperPablo Neira Ayuso
This patch adds support for the DHCPv6 helper. 1) nfct helper add dhcpv6 inet6 udp 2) ip6tables -I OUTPUT -t raw -p udp --sport 546 -j CT --helper dhcpv6 3) run conntrackd You should see: % conntrack -L exp -f ipv6 279 proto=17 src=:: dst=ff02::1:2 sport=0 dport=546 mask-src=:: mask-dst=ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff sport=0 dport=65535 master-src=fe80::221:ccff:fe4a:7f9c master-dst=ff02::1:2 sport=546 dport=547 PERMANENT class=0 helper=dhcpv6 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-09-26conntrackd: cthelper: allow to attach expectations via nfqueuePablo Neira Ayuso
This requires the Linux kernel 3.12. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-09-15conntrack: do not exit when update returns an errorFlorian Westphal
If we fail to update an entry, just try to continue with the next one instead of exiting. Can happen f.e. when using "conntrack -U --add-label bla", but the conntrack entry in the kernel does not have the label extension set. Signed-off-by: Florian Westphal <fw@strlen.de>
2013-09-15conntrack: support add/delete of conntrack labelsClemence Faure
new options "--label-add" and "--label-delete" to alter connlabels assigned to a connection. Signed-off-by: Clemence Faure <clemence.faure@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2013-09-15conntrack: support multiple -l optionsFlorian Westphal
Using -l foo -l bar caused the "foo" label to be lost. Merge multiple -l options so "-l foo,bar" and "-l foo -l bar" have same effect. Signed-off-by: Florian Westphal <fw@strlen.de>
2013-09-04conntrack: minor cleanupFlorian Westphal
Rename get_table to generic "optional argument handling" helper, so it can be re-used in upcoming patch. While at it, avoid copy&paste of "labelmap" handling. Signed-off-by: Florian Westphal <fw@strlen.de>
2013-08-07conntrack: fix dump of IPv6 entries in the dying and unconfirmed listPablo Neira Ayuso
Use selected the family, instead of inconditionally request for IPv4. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-08-06conntrack-tools 1.4.2 releasePablo Neira Ayuso
bump dependency with libnetfilter_conntrack to 1.0.4, otherwise we don't get the connlabel support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-08-06cthelper: fix IPv6 address and mask in newly created expectationsPablo Neira Ayuso
Set to zero the entire address if needed, not just 4 bytes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-07-24conntrack: fix reporting of unknown argumentsClemence Faure
short options were always reported as "unknown argument". getopt(3) says: if [it] finds an option character in argv that was not included in optstring, or if it detects a missing option argument, it returns '?' and sets the external variable optopt to the actual option character. If the first character [...] of optstring is a colon (':'), then getopt() returns ':' instead of '?' to indicate a missing option argument. Signed-off-by: Clemence Faure <clemence.faure@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2013-07-24conntrack: fix -L format outputFlorian Westphal
commit d343b8c (conntrack: add connlabel format attribute) erronously removed _UNKNOWN format, i.e. conntrack -L displayed [UPDATE] tcp 6 114 TIME_WAIT src=.. ^^^^^ Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
2013-07-23conntrackd: support replication of connlabelsFlorian Westphal
- check if ct has label attribute, and at least one label (bit) is set - serialize bitmap into array-of-u32, in network byte order - add code to build new nfct_bitmask object from array-of-u32 Current parse functions don't have length information, this adds optional parse2() which gets struct netattr pointer. Attributes that want to use parse2 need to set .maxsize to nonzero value. Signed-off-by: Florian Westphal <fw@strlen.de>
2013-07-23conntrack: introduce -l option to filter by labelsClemence Faure
Signed-off-by: Clemence Faure <clemence.faure@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2013-07-11conntrackd: simplify expectation filteringPablo Neira Ayuso
This patch simplifies the expectation filtering by looking up for the master conntrack. If it does not exists, then we assume that we don't want this expectation either. This simplification also fixes the current broken expectation filtering, since the master conntrack from expectations has neither reply tuple nor state, however, the filtering code assumes the opposite. This partially reverts (479a37a conntrackd: fix crash with IPv6 expectation in the filtering code) since it was incorrectly setting the reply tuple of the master conntrack. Thanks to Bill Fink for providing feedback to resolve this issue. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-07-06conntrackd: fix crash with IPv6 expectation in the filtering codePablo Neira Ayuso
Jul 5 00:41:06 sen-fw1 kernel: [274422.060695] conntrackd[4821]: segfault at 0 ip 000000000040c660 sp 00007fffebb098a8 error 4 in conntrackd[400000+3d000] > #0 0x000000000040f217 in jhash2 (k=0x0, length=4, initval=0) at ../include/jhash.h:99 > a = 2654435769 b = 2654435769 c = 0 len = 4 > #1 0x000000000040f564 in ct_filter_hash6 (data=0x0, table=0x16ef630) at filter.c:57 > #2 0x000000000040ad34 in hashtable_hash (table=0x16ef630, data=0x0) at hash.c:63 > #3 0x000000000040fd19 in __ct_filter_test_ipv6 (f=0x16eeba0, ct=0x1703760) at filter.c:265 > id_src = 51 id_dst = 24051376 src = 0x1703760 dst = 0x0 The master conntrack of the expectation has no reply tuple. However, the filtering routine needs it. To avoid this issue, emulate the source address in the reply tuple. While at it, fix incorrect sanity checking that should have caught this issue. Thanks to Florian Westphal for initial diagnosing of this bug. Reported-by: Bill Fink <billfink@mindspring.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-07-06conntrackd: deprecate `Family' in configuration filePablo Neira Ayuso
This patch deprecates the `Family' tweak in the configuration file. Several reasons for this: * If not specified, this was default to IPv4 only in table dumps from the kernel. However, non-IPv4 events were still received. This is inconsistent. * It's an early tweak that was not documented (not included in any of the example files). If we want to support any sort of consistent filtering based on the family, this should happen in the filtering code. After this patch, conntrackd uses AF_UNSPEC to dump the conntrack and expectation tables from the kernel. Reported-by: Bill Fink <billfink@mindspring.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-07-06conntrackd: cache: fix hashing based on IPv6 addressPablo Neira Ayuso
Use source and destination address, not only source address for hashing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-07-05conntrack: add connlabel format attributeFlorian Westphal
Signed-off-by: Florian Westphal <fw@strlen.de>
2013-06-07cthelper: helpers may not use private information areaPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-06-07cthelper: add IPv6 supportPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-06-07tests: cthelper: remove test infrastructure from this treePablo Neira Ayuso
I decided to move it to: http://git.netfilter.org/conntrackd-helper-tests to reduce the bloat of this tree, most people are not interested in this stuff when they grab it via git clone. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-06-05include: kill unused PLD_* macrosFlorian Westphal
Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-06-05conntrackd: fix compiler warningsFlorian Westphal
main.c:359:6: warning: ignoring return value of 'nice' [..] main.c:395:7: warning: ignoring return value of 'chdir' [..] run.c:43:17: warning: declaration of 'signal' shadows a global declaration Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-05-15conntrack: fix timestamps when microseconds are less than 100000Pablo Neira Ayuso
The fractional portion of timestamps reported by conntrack is printed as a left-justified integer instead of fixed-width and zero-padded. Closes netfilter's bugzilla 817: https://bugzilla.netfilter.org/show_bug.cgi?id=817 Reported-by: hoffman@stanford.edu Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-03-20conntrackd: fix parsing of non-abbreviated IPv6 address in config fileJames Guthrie
Both representations of this example IPv6 address should be accepted: fe80::1 fe80:0:0:0:0:0:0:1 This patch fixes the lexical parser for non-abbreviated version, which was not working. Signed-off-by: James Guthrie <jag@open.ch> Signed-off-by: Roman Hoog Antink <rha@open.ch> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-03-04build: requires libnetfilter_conntrack >= 1.0.3Pablo Neira Ayuso
Reported-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2013-03-03build: bump version to 1.4.1Pablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-12-04conntrack: add support to dump the dying and unconfirmed list via ctnetlinkPablo Neira Ayuso
This patch adds support for: conntrack -L dying conntrack -L unconfirmed To display the list of dying and unconfirmed conntracks. This provides some instrumentation in case that `conntrack -C` really deviates from what `conntrack -L | wc -l` says. Users like to check this to make sure things are going OK. Still, some conntrack objects may be still in the dying and the unconfirmed list. With this patch, we can also dump their content, before it was not possible. In normal cases both lists would be simply empty, or in the case of the dying list, you can observe that entries go slightly down in number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-11-06conntrackd: fix deadlock due to wrong nested signal blockingPablo Neira Ayuso
The existing code may nest several signal blocking and unblocking calls in different paths of the code. This may result in deadlocks while receiving signals. This patch simplifies the signal blocking approach. Now signals are blocked in three paths: 1) Internal timers handling, while running timer callback for expired timers. 2) File descriptor handling, while running file descriptor callbacks. 3) While handling signals, to avoid that SIGINT and SIGTERM in a row results in a deadlock. Thanks a lot to Ulrich Weber <ulrich.weber@sophos.com> for discussing a fix for this problem. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-10-08bump version to 1.4.0 and update dependenciesPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-10-08doc: detail user-space helper supportPablo Neira Ayuso
This patch adds documentation on how to enable user-space helper support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-10-04conntrackd: fix crash if ExpectationSync is enabled on old Linux kernelsPablo Neira Ayuso
ExpectationSync requires Linux kernel >= 3.5 to work sanely, document this. Still, we don't want to crash if someone enables expectation sync with old Linux kernels (like 2.6.32). Reported-by: James Gutholm <gutholmj@evergreen.edu> Tested-by: James Gutholm <gutholmj@evergreen.edu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-09-21build: fix libraries dependencies in MakefilesNicolas Dichtel
Several includes are missing when netfilter libs are not in the standard path. Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-09-10conntrackd: cthelper: add QueueLen optionPablo Neira Ayuso
This patch adds the QueueLen option, that allows you to increase the maximum number of packets waiting in the nfnetlink_queue to receive a verdict from userspace. Rising the default value (1024) is useful to avoid hitting the following error message: "nf_queue: full at X entries, dropping packets(s)". Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-09-08conntrackd: parse: fix wrong maximum length for ATTR_EXP_FNPablo Neira Ayuso
It was set to NFCT_HELPER_NAME_MAX (16 bytes), but we have function names that are larger, eg. nf-nat-follow-master which is 18 bytes long. This leads to hitting malformed message while synchronizing expectations. I'll add some new constant to libnetfilter_conntrack instead of hardcoding this, later. Reported-by: Gaurav Sinha <gaurav.sinha@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-08-24tests: conntrackd: fix compile errors and warningsAnsis Atteka
This patch fixes few compile warnings and errors. Signed-off-by: Ansis Atteka <aatteka@nicira.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-08-21cthelper: ftp: fix EPRT case for IPv4Pablo Neira Ayuso
%pI4 also exists in the Linux kernel. It would be good to have some generic functions to convert binary data to address string. Later. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-08-21cthelper: disable debugging information by defaultPablo Neira Ayuso
The pr_debug call should be converted to use dlog instead. I'll try to add some some configuration parameter to enable/disable debugging in runtime. This is not very flexible. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-08-03conntrackd: don't resync expectations if such sync has been disabledVincent Bernat
conntrackd was segfaulting with `ExpectationSync` set to `Off` and PollSecs (polling mode) in use. Signed-off-by: Vincent Bernat <bernat@luffy.cx> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-09 15:28:44 +0000