summaryrefslogtreecommitdiff
path: root/src/conntrack.c
AgeCommit message (Collapse)Author
2012-05-30Merge branch 'cthelper9' of git://git.netfilter.org/conntrack-tools into ↵Gaurav Sinha
user_space_helpers Conflicts: .gitignore src/run.c
2012-05-20conntrack: flush stdout for each expectation event, tooFlorian Westphal
else, piping "conntrack -E expect" output will be buffered/delayed, which is not what users expect. Normal conntrack events are already flushed. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-02-14conntrack: allow to filter by mark from kernel-spacePablo Neira Ayuso
This patch uses the new infrastructure that allows us to filter by mark from kernel-space. This change ensures backward compatibility with kernels with no support for filtering by mark (Linux kernel <= 3.4.x). This requires lastest libnetfilter_conntrack library. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-01-23Merge branch 'upstream' into oxnardGaurav Sinha
2012-01-23Merge branch 'master' of git://git.netfilter.org/conntrack-tools into upstreamGaurav Sinha
2012-01-23conntrack: fix setting fixed-timeout status flagPablo Neira Ayuso
% conntrack -U -u FIXED_TIMEOUT conntrack v1.0.1 (conntrack-tools): Operation failed: Device or resource busy With this patch, you can make indeed make it: % conntrack -U -u FIXED_TIMEOUT [...] conntrack v1.0.1 (conntrack-tools): 8 flow entries have been updated. This patch also adds the corresponding simple QA tests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-01-22conntrack: add expectation support for `-o' optionPablo Neira Ayuso
Now you can dump expectations in XML format and display the timestamp. conntrack -L exp -o xml,timestamp <?xml version="1.0" encoding="utf-8"?> <expect> <flow><layer3 protonum="2" protoname="ipv4"><expected><src>192.168.1.135</src><dst>130.89.148.12</dst></expected><mask><src>255.255.255.255</src><dst>255.255.255.255</dst></mask><master><src>192.168.1.135</src><dst>130.89.148.12</dst></master></layer3><layer4 protonum="6" protoname="tcp"><expected><sport>0</sport><dport>32877</dport></expected><mask><sport>0</sport><dport>65535</dport></mask><master><sport>49881</sport><dport>21</dport></master></layer4><meta><helper-name>ftp</helper-name><timeout>294</timeout><when><hour>21</hour><min>22</min><sec>09</sec><wday>1</wday><day>22</day><month>1</month><year>2012</year></when></meta></flow> </expect> You have to upgrade libnetfilter_conntrack to access this feature. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2012-01-18Creating development branch expect-sync, has merged content from oxnard and ↵expect-syncGaurav Sinha
upstream
2012-01-12Updating upstream with merged content from netfilter conntrack-tools version ↵Gaurav Sinha
1.0.1
2011-07-08conntrack: add missing break when parsing --id/--secmark optionsFlorian Westphal
commit 147ed522f52a62ab0d854ddc443d27d97dbf6cdf (conntrack: add support for mark mask) failed to add a break after secmark/id option parsing. Results in '-m 42 -c 1' to search for mark 1 instead of 42. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-06-22conntrack: remove unused variable with -SPablo Neira Ayuso
Error: UNUSED_VALUE: conntrack-tools-1.0.0/src/conntrack.c:1297: returned_pointer: Pointer "nl" returned by "strchr(buf, 10)" is never used. Reported-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-06-15conntrack: skip sending update message to kernel if conntrack is unchangedFlorian Westphal
This speeds up operation when a lot of conntracks exist, but only a few of them have to be altered. This change is user-visible because the exit message ("%d flow entries have been updated") will now print the number of entries that have been altered instead of the total number of conntracks seen. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-06-15conntrack: add support for mark maskFlorian Westphal
Extend --mark option to optionally take a mask, seperated by '/', e.g. --mark 0x80/0xf0. When used with -L, only test those bits of the mark that are in the mask range (behaves like iptables like -m mark). When used with -U, zero out those bits indicated by the mask and XOR the new mark into the result (behaves like iptables -j MARK --set-xmark). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-22conntrack: display informative message if expectation table is flushedPablo Neira Ayuso
With this patch, we display the following message after: # conntrack -F expect conntrack v0.9.15 (conntrack-tools): expectation table has been emptied. To make it consistent with the message displayed with conntrack -F. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-17conntrack: allocate template objects in the heapPablo Neira Ayuso
With this patch, we don't abuse the stack anymore, instead we allocate the template objects that are used in the heap. We stop using nfct_maxsize() which is now deprecated in libnetfilter_conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2011-02-17conntrack: add -o ktimestamp option (it requires linux >= 2.6.38)Pablo Neira Ayuso
This option requires Linux kernel >= 2.6.38, you have to enable conntrack timestamping with: echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp # conntrack -L -o ktimestamp udp 17 59 src=192.168.1.128 dst=192.168.1.1 sport=52050 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=52050 [ASSURED] mark=0 delta-time=121 [start=Thu Feb 17 17:41:18 2011] use=1 # conntrack -L conntrack v0.9.15 (conntrack-tools): 20 flow entries have been shown. udp 17 31 src=192.168.1.128 dst=192.168.1.1 sport=52050 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=52050 [ASSURED] mark=0 delta-time=149 use=1 # conntrack -E -o ktimestamp ... [DESTROY] udp 17 src=192.168.1.128 dst=192.168.1.1 sport=40162 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=40162 [ASSURED] delta-time=3 [start=Thu Feb 17 17:44:57 2011] [stop=Thu Feb 17 17:45:00 2011] # conntrack -E [DESTROY] udp 17 src=192.168.1.128 dst=77.226.252.14 sport=123 dport=123 src=77.226.252.14 dst=192.168.1.128 sport=123 dport=123 delta-time=8 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-10-12conntrack: allow to listen to all kind of expectation eventsPablo Neira Ayuso
So far, conntrack only allows to listen to events of new expectations. With this patch, we can listen to events of destroyed expectations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-05conntrack: add zone supportPablo Neira Ayuso
This patch adds `--zone' to the command line tool. This adds the missing user-space support for Patrick's McHardy iptables CT target. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: cleanup parsing of the NAT argumentsPablo Neira Ayuso
This patch cleans up nat_parse() and it also displays nicer error message for malformed arguments. % conntrack -L --src-nat :80 conntrack v0.9.14 (conntrack-tools): No IP specified Try `conntrack -h' or 'conntrack --help' for more information. % conntrack -L --src-nat 1.1.1.1: conntrack v0.9.14 (conntrack-tools): No port specified after `:' Try `conntrack -h' or 'conntrack --help' for more information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --[src|dst|any]-nat IP:PORT' if port mismatchesPablo Neira Ayuso
This patch fixes the filtering if the IP matches an entry but the PORT does not matches. Without this patch, the entry is shown when it should be not. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: --[src|dst|any]-nat requires IP:PORT as argumentPablo Neira Ayuso
This patch restricts the behaviour that we previously introduced in 142606c60808b3ab0496155ac3d086765e6baef3. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --any-nat 1.1.1.1' filteringPablo Neira Ayuso
This patch adds the missing bits to allow to filter with --any-nat based on the IP address. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --src-nat 1.1.1.1' if PAT appliedPablo Neira Ayuso
This patch fixes another scenario in which the flow has some PAT mangling and we passed the src-nat address that we want to use to perform the filtering. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix `conntrack --src-nat 3.3.3.3' and similarPablo Neira Ayuso
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: fix bogus NATted flows in filteringPablo Neira Ayuso
With this patch, conntrack does not show bogus entries that have no NAT applied due to a relaxed checking. conntrack -L --src-nat :80 tcp 6 342824 ESTABLISHED src=XX.214.188.80 dst=66.XX.7.180 sport=80 dport=13749 packets=4 bytes=6000 [UNREPLIED] src=66.XX.7.180 dst=XX.214.188.80 sport=13749 dport=80 packets=0 bytes=0 mark=0 secmark=0 use=1 conntrack v0.9.14 (conntrack-tools): 1 flow entries have been shown. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: re-fix inconsistent display with `--src-nat' and `--dst-nat'Pablo Neira Ayuso
In 142606c60808b3ab0496155ac3d086765e6baef3, I re-introduced the inconsistent behaviour that I described in 85f94171a71880c744f265268f33ad58819caa74. Great. This patch fixes this again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-07-01conntrack: add `--any-nat' to filter any NATted flowPablo Neira Ayuso
This patch adds the --any-nat option that allows to display src-NATted OR dst-NATted flows. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-28conntrack: fix port filter with `--src-nat' and `--dst-nat'Pablo Neira Ayuso
This patch allows the following command to filter port-based NAT: $ conntrack -L --dst-nat :9999 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-22conntrack: put all the commands and options code togetherPablo Neira Ayuso
This patch is a cleanup, it puts all the commands and options code together. This makes easier and less error-prone the task to add new commands and options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-22conntrack: expand array that maps option-flags to option-namesPablo Neira Ayuso
This patch is a cleanup, it expands an array that contains the correspondence between the option-flags and the option-names. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-17conntrack: fix `conntrack -L -n -g` filter using AND, not OR logicPablo Neira Ayuso
2010-06-17conntrack: fix `conntrack -L -n -g` (second try)Pablo Neira Ayuso
2010-06-17Revert "fix `conntrack -L --src-nat --dst-nat`"Mohit Mehta
This reverts commit b4d4591734726a7b38a579acf272022caf5a0534.
2010-06-17conntrack: `-L --src-nat --dst-nat' filter using AND, not OR logicPablo Neira Ayuso
The patch that I committed in 2e06d62d341fdf936dbc1fa944d5e03f761aaf0e was incomplete. With it, `-L --src-nat --dst-nat' shows source-natted OR destination-natted flows. This patch changes the behaviour to show source-natted AND destination-natted flows. This is the consistent behaviour that we expect from conntrack (this is how it works for other options indeed). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-17conntrack: fix `conntrack -L --src-nat --dst-nat' (second try)Pablo Neira Ayuso
This patch fixes the filtering with --src-nat and --dst-nat options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-17conntrack: revert fix `-L --src-nat --dst-nat'Pablo Neira Ayuso
This patch reverts 0865d22af0ec5876f721d44c90ac898fdfa435aa since it breaks conntrack listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2010-06-15fix `conntrack -L --src-nat --dst-nat`Pablo Neira Ayuso
2010-06-14debian conntrack 0.9.14-2root
2010-06-10conntrack: fix `-L --src-nat --dst-nat'Pablo Neira Ayuso
Since > 0.9.6, the conntrack listing with the options --src-nat and --dst-nat does not work. This patch fixes the problem. Reported-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-10-08conntrack: use fscanf() instead of read() for showing counterHannes Eder
Read an integer right away with fscanf() instead of read()-ing to a buffer, which was actually to small for the terminating '\0', and atoi()-ing. Furthermore read() might not read enough, though unlikely here. Signed-off-by: Hannes Eder <heder@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-10-08conntrack: avoid error with expectations when using 'conntrack -E -e ALL ...'Hannes Eder
Avoid this error: conntrack v0.9.13 (conntrack-tools): Operation failed: No such file or directory when using 'conntrack -E -e ALL ...'. This is caused by the fact that netfilter expectations also get delivered, but things are not setup for this, nfnl_catch returns -1 and errno = ENOENT. Signed-off-by: Hannes Eder <heder@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-10-07conntrack: fix output when no arguments are passedHannes Eder
When 'conntrack' is called with no arguments then garbage is printed after the usage message. This patch fixes this. Signed-off-by: Hannes Eder <heder@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-04-18conntrack: add GRE supportPablo Neira Ayuso
This patch adds GRE support for the command line tool conntrack. With this patch, we support all protocols available in the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.
2009-04-14conntrack: fix English typo in output messagePablo Neira Ayuso
This patch fixes an English typo in an output message. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-04-11conntrack: add DCCP supportPablo Neira Ayuso
This patch adds DCCP support for the command line tool conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-04-11conntrack: add SCTP supportPablo Neira Ayuso
This patch adds SCTP support to the command line tool conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-04-11conntrack: add UDPlite supportPablo Neira Ayuso
This patch adds UDPlite support for the command line tool conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-04-11conntrack: fix coupled-options sanity checkingsPablo Neira Ayuso
This patch extends the generic_opt_check() function to add extra information on the possible option combinations. Under some specific situations, like the creation and getting of a conntrack, you may specify the original or the reply tuple but at least one MUST be present. This handling has been always tricky, it still remains but we're more user friendly at least. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-03-31conntrack: remove broken command checking codePablo Neira Ayuso
This patch removes the broken command checking. This is better handled by the option checkings which comes just after this one. This patch also fixes some inconsistencies in the command parameter checking when long names are used. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2009-03-31conntrack: add `-S' command to display kernel statisticsPablo Neira Ayuso
This patch adds `-S' command to display kernel statistics. Using raw `cat' on /proc and the hexadecimal output is not very handy. This option parses the /proc entry and display the information is a more human friendly way. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-29 03:13:35 +0000