summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* conntrackd: basic TIPC supporttipcQuentin Aebischer2012-02-1412-85/+653
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Basic implementation of a TIPC channel for the conntrackd daemon (successfully tested in NOTRACK and FTFW modes). TIPC is a protocol that allows applications in a cluster-based environment to communicate quickly and reliably with other applications in the cluster. It allows both unicast and multicast, reliable/unreliable and datagram/stream oriented communications. One of its main feature's of interest here is to provide sockets that communicates in a connectionless, yet reliable manner that guarantees delivery of every message sent over the network. This can be useful in the context of high-available, cluster-based firewalls where states propagation has to be both fast and reliable. So far, the results are encouraging, though more tests have to performed on different setups to enhance the implementation and track any bugs. An example config file can be found in the doc/sync/ directory of the conntrack-tools, along with a README file providing basic installation instructions. Signed-off-by: Quentin Aebischer <quentin.aebischer@usherbrooke.ca>
* conntrackd: fix parsing of expectation class, helper name and NATPablo Neira Ayuso2012-02-071-1/+17
| | | | | | | | | | | | | | | | | | I forgot to modify the body of msg2exp to include the recently committed support for the expectation class, helper name and NAT. This patch fixes the problem. Now in node-1 (primary), it shows: proto=17 src=192.168.11.4 dst=192.168.10.5 sport=0 dport=5060 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.10.5 master-dst=192.168.11.4 sport=5060 dport=5060 PERMANENT class=0 helper=sip [active since 31s] And it node-2 (secondary), it shows: proto=17 src=192.168.11.4 dst=192.168.10.5 sport=0 dport=5060 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.10.5 master-dst=192.168.11.4 sport=5060 dport=5060 PERMANENT class=0 helper=sip [active since 180s] This has been tested with the SIP conntrack helper. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: support expectfn synchronization for expectationsPablo Neira Ayuso2012-02-073-0/+8
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add support to synchronize helper namePablo Neira Ayuso2012-02-073-2/+55
| | | | | | For both conntrack and expectations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add NAT expectation supportPablo Neira Ayuso2012-02-073-0/+42
| | | | | | This patch adds the missing bits to support NAT expectation support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add support expectation class synchronizationPablo Neira Ayuso2012-02-073-0/+8
| | | | | | This patch adds support for synchronizing the expectation class. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix setting fixed-timeout status flagPablo Neira Ayuso2012-01-232-0/+19
| | | | | | | | | | | | | | | % conntrack -U -u FIXED_TIMEOUT conntrack v1.0.1 (conntrack-tools): Operation failed: Device or resource busy With this patch, you can make indeed make it: % conntrack -U -u FIXED_TIMEOUT [...] conntrack v1.0.1 (conntrack-tools): 8 flow entries have been updated. This patch also adds the corresponding simple QA tests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: support `-i exp -x' and `-e exp -x' optionsPablo Neira Ayuso2012-01-223-0/+18
| | | | | | | | | | This patch allows you to dump the internal and external expectation cache in XML. % conntrackd -i exp -x <flow><layer3 protonum="2" protoname="ipv4"><expected><src>192.168.1.135</src><dst>130.89.148.12</dst></expected><mask><src>255.255.255.255</src><dst>255.255.255.255</dst></mask><master><src>192.168.1.135</src><dst>130.89.148.12</dst></master></layer3><layer4 protonum="6" protoname="tcp"><expected><sport>0</sport><dport>9082</dport></expected><mask><sport>0</sport><dport>65535</dport></mask><master><sport>50518</sport><dport>21</dport></master></layer4><meta><helper-name>ftp</helper-name></meta></flow> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add expectation support for `-o' optionPablo Neira Ayuso2012-01-221-7/+64
| | | | | | | | | | | | | | Now you can dump expectations in XML format and display the timestamp. conntrack -L exp -o xml,timestamp <?xml version="1.0" encoding="utf-8"?> <expect> <flow><layer3 protonum="2" protoname="ipv4"><expected><src>192.168.1.135</src><dst>130.89.148.12</dst></expected><mask><src>255.255.255.255</src><dst>255.255.255.255</dst></mask><master><src>192.168.1.135</src><dst>130.89.148.12</dst></master></layer3><layer4 protonum="6" protoname="tcp"><expected><sport>0</sport><dport>32877</dport></expected><mask><sport>0</sport><dport>65535</dport></mask><master><sport>49881</sport><dport>21</dport></master></layer4><meta><helper-name>ftp</helper-name><timeout>294</timeout><when><hour>21</hour><min>22</min><sec>09</sec><wday>1</wday><day>22</day><month>1</month><year>2012</year></when></meta></flow> </expect> You have to upgrade libnetfilter_conntrack to access this feature. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix expectation filtering if ExpectationSync On is usedPablo Neira Ayuso2012-01-221-1/+2
| | | | | | | | | | If ExpectationSync On is used, we synchronize no expectations at all due to a problem in the event filtering. This is bug, this patch fixes the problem. Reported-by: Gaurav Sinha <gaurav.sinha@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update conntrack-tools manual to detail expectation supportPablo Neira Ayuso2012-01-101-2/+159
| | | | | | | This patch updates the user manual on how to enable the expectation support for conntrackd. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: support for expectation synchronizationPablo Neira Ayuso2012-01-1033-71/+1889
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support to synchronize expectations between firewalls. This addition aims to re-use as much as possible of the existing infrastructure for stability reasons. The expectation support has been tested with the FTP helper. This extension requires libnetfilter_conntrack 1.0.0. If this is the first time you're playing with conntrackd, I *strongly* recommend you to get working setup of conntrackd without expectation support before as described in the documentation. Then, enabling expectation support is rather easy. To know more about expectations, if you're not familiar with them, I suggest you to read: "Netfilter's Connection Tracking System" http://people.netfilter.org/pablo/docs/login.pdf Reprinted from ;login: The Magazine of USENIX, vol. 31, no. 3 (Berkeley, CA: USENIX Association, 2006, pp40-45.) In short, expectations allow one Linux firewall to filter multi-flow traffic like FTP, SIP and H.323. In my testbed, there are two firewalls in a primary-backup configuration running keepalived. The use a couple of floating cluster IP address (192.168.0.100 and 192.168.1.100) that are used by the client. These firewalls protect one FTP server (192.168.1.2) that will be accessed by one client. In ASCII art, it looks like this: 192.168.0.100 192.168.1.100 eth1 eth2 fw-1 / \ FTP -- client ------ ------ server -- 192.168.0.2 \ / 192.168.1.2 fw-2 This is the rule-set for the firewalls: -A POSTROUTING -t nat -s 192.168.0.2/32 -d 192.168.1.2/32 -j SNAT --to-source 192.168.1.100 -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -m state --state INVALID -j DROP -A FORWARD -m state --state RELATED -j ACCEPT -A FORWARD -i eth2 -m state --state ESTABLISHED -j ACCEPT -A FORWARD -i eth1 -p tcp -m tcp --dport 21 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT -A FORWARD -i eth1 -p tcp -m state --state ESTABLISHED -j ACCEPT -A FORWARD -m state --state INVALID -j LOG --log-prefix "invalid: " The following steps detail how to check that the expectation support works fine for conntrackd: 1) You have to enable the expectation support in the configuration file with the following option: Sync { ... Options { ExpectationSync { ftp sip h323 } } } This enables expectation synchronization for the FTP, SIP and H.323 helpers. You can alternatively use: Sync { ... Options { ExpectationSync On } } To enable expectation synchronization for all helpers. 2) Make sure you have loaded the FTP helper in both firewalls. root@fw1# modprobe nf_conntrack_ftp root@fw2# modprobe nf_conntrack_ftp 3) Switch to the client. Start one FTP control connection to one server that is protected by the firewalls, enter passive mode: (term-1) user@client$ nc 192.168.1.2 21 220 dummy FTP server USER anonymous 331 Please specify the password. PASS nothing 230 Login successful. PASV 227 Entering Passive Mode (192,168,1,2,163,11). This means that port 163*256+11=41739 will be used for the data traffic. Read this if you are not familiar with the FTP protocol: http://www.freefire.org/articles/ftpexample.php 3) Switch to fw-1 (primary) to check that the expectation is in the internal cache. root@fw1# conntrackd -i exp proto=6 src=192.168.0.2 dst=192.168.1.2 sport=0 dport=41739 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.0.2 master-dst=192.168.1.2 sport=36390 dport=21 [active since 5s] 4) Switch to fw-2 (backup) to check that the expectation has been successfully replicated. root@fw2# conntrackd -e exp proto=6 src=192.168.0.2 dst=192.168.1.2 sport=0 dport=41739 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.0.2 master-dst=192.168.1.2 sport=36390 dport=21 [active since 8s] 5) Make the primary firewall fw-1 fail. Now fw-2 becomes primary. 6) Switch to fw-2 (primary) to commit the external cache into the kernel. root@fw2# conntrackd -c exp The logs should display that the commit was successful: root@fw2# tail -100f /var/log/conntrackd.log [Wed Dec 7 22:16:31 2011] (pid=19195) [notice] committing external cache: expectations [Wed Dec 7 22:16:31 2011] (pid=19195) [notice] Committed 1 new entries [Wed Dec 7 22:16:31 2011] (pid=19195) [notice] commit has taken 0.000366 seconds 7) Switch to the client. Open a new terminal and connect to the port that has been announced by the server: (term-2) user@client$ nc -vvv 192.168.1.2 41739 (UNKNOWN) [192.168.1.2] 41739 (?) open 8) Switch to term-1 and ask for the file listing: [...] 227 Entering Passive Mode (192,168,1,2,163,11). LIST 9) Switch to term-2, it should display the listing. That means everything has worked fine. You may want to try disabling the expectation support and repeating the steps to check that *it does not work* without the state-synchronization. You can also display expectation statistics by means of: root@fwX# conntrackd -s exp This update requires no changes in the primary-backup.sh script that is used by the HA manager to interact with conntrackd. Thus, we provide a backward compatible command line interface. Regarding the Filter clause and expectations, we use the master conntrack to filter expectation events. The filtering is performed in user-space. No kernel-space filtering support for expectations yet (this support should go in libnetfilter_conntrack at some point). This patch also includes support to disable caching and to allow direct injection of expectations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: minor cleanup for commitPablo Neira Ayuso2012-01-102-6/+9
| | | | | | Comestical cleanup for better code readability. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: relax checkings in ct_filter_sanity_checkPablo Neira Ayuso2012-01-101-6/+2
| | | | | | | | | | | This is required to prepare the expectation support. The master, expect and mask objects that are part of the conntrack object do not have any reply information. This allows the expectation support to re-use the existing filtering infrastructure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: constify ct parameter of ct_filter_* functionsPablo Neira Ayuso2012-01-102-7/+9
| | | | | | | The ct object that is passed as parameter is not modified, make it constant. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: remove cache_data_get_object and replace by direct pointerPablo Neira Ayuso2012-01-105-30/+19
| | | | | | | We now include one pointer to the object in the extra section. This is required to generalize this code for the expectation support. We consume 4-8 bytes extra, but we will not need more changes to support expectations which is a good idea.
* conntrackd: simplify cache_get_extra functionPablo Neira Ayuso2012-01-105-13/+8
| | | | | | | | This patch simplifies cache_get_extra which now takes only one parameter that is the cache_object. With it, the extra area can be calculated. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: generalize local handler actionsPablo Neira Ayuso2012-01-105-49/+49
| | | | | | | This patch prepares the introduction of actions with the expectation table. Mostly renamings. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: generalize/cleanup network message building/parsingPablo Neira Ayuso2012-01-1011-131/+155
| | | | | | | | | | | | | | | | | | This patch generalizes the network message building and parsing to prepare the upcoming expectation support. Basically, it renames: - NET_T_STATE_* by NET_T_STATE_CT_*, as I plan to add NET_T_STATE_EXP_* - BUILD_NETMSG by BUILD_NETMSG_FROM_CT, and build_payload by ct2msg. I plan to add exp2msg. - parse_payload by msg2ct, since I plan to add msg2exp. - modify object_status_to_network_type to prepare the support of expectations. - add prefix ct_ to all parsing functions in parse.c, as we will have similar functions to convert messages to expectation objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: generalize external handlers to prepare expectation supportPablo Neira Ayuso2012-01-104-54/+62
| | | | | | | | | | This patch contains cleanups to prepare the expectation support for external handlers. Mostly renamings. I have also updated the file headers to include Vyatta in the copyright statement. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: generalize caching infrastructurePablo Neira Ayuso2012-01-1014-306/+429
| | | | | | | | This patch generalizes the caching infrastructure to store different object types. This patch is the first in the series to prepare support for the synchronization of expectations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: bump version to 1.0.1conntrack-tools-1.0.1Pablo Neira Ayuso2012-01-041-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix checking of return value of queue_add()Pablo Neira Ayuso2012-01-043-9/+13
| | | | | | | | | | | | | | | | Most callers of queue_add() assume that it returns != 0 in case of success. However, it may return -1 in case that the queue gets full. In that case, most callers have to: - release the object that they want to enqueue. - decrement the refcount, in case they have bumped it. However, most of these callers are using the tx_queue which currently has no limit in size at all. This fix is necessary in case that I decide to limit the size of the transmission queue in the future (which makes a lot of sense indeed). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: primary-backup.sh: clarify licensing terms (GPLv2+)Pablo Neira Ayuso2011-12-301-4/+6
| | | | | | | This script is released under GPLv2+. Update copyright notice as well. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'master' of git://dev.medozas.de/conntrack-toolsPablo Neira Ayuso2011-12-272-10/+7
|\
| * build: disable implicit .tar.gz archive generation and use POSIX modeJan Engelhardt2011-12-171-1/+2
| |
| * build: use AC_CONFIG_AUX_DIR and stash away toolsJan Engelhardt2011-12-172-6/+2
| |
| * Update .gitignoreJan Engelhardt2011-12-171-3/+3
| | | | | | | | Only ignore these paths if they are a directory.
* | conntrackd: fix filtering of dump output if internal cache is disabledPablo Neira Ayuso2011-12-191-0/+3
|/ | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add missing initial caching of gettimeofday()Pablo Neira Ayuso2011-10-241-0/+2
| | | | | | | | | | | Thus, we fix conntrackd -i for flows that were just retrieved from the kernel: tcp 6 ESTABLISHED src=192.168.1.135 dst=208.68.163.220 sport=42179 dport=5222 src=208.68.163.220 dst=192.168.1.135 sport=5222 dport=42179 [ASSURED] mark=0 [active since 1319450515s] Note the wrong "active since" value. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add missing break when parsing --id/--secmark optionsFlorian Westphal2011-07-081-0/+1
| | | | | | | | | | | commit 147ed522f52a62ab0d854ddc443d27d97dbf6cdf (conntrack: add support for mark mask) failed to add a break after secmark/id option parsing. Results in '-m 42 -c 1' to search for mark 1 instead of 42. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* testsuite: add tests for --mark optionFlorian Westphal2011-07-082-0/+30
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: remove unused variable with -SPablo Neira Ayuso2011-06-221-3/+2
| | | | | | | | Error: UNUSED_VALUE: conntrack-tools-1.0.0/src/conntrack.c:1297: returned_pointer: Pointer "nl" returned by "strchr(buf, 10)" is never used. Reported-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: skip sending update message to kernel if conntrack is unchangedFlorian Westphal2011-06-151-0/+6
| | | | | | | | | | | | This speeds up operation when a lot of conntracks exist, but only a few of them have to be altered. This change is user-visible because the exit message ("%d flow entries have been updated") will now print the number of entries that have been altered instead of the total number of conntracks seen. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for mark maskFlorian Westphal2011-06-152-3/+73
| | | | | | | | | | | | | | | Extend --mark option to optionally take a mask, seperated by '/', e.g. --mark 0x80/0xf0. When used with -L, only test those bits of the mark that are in the mask range (behaves like iptables like -m mark). When used with -U, zero out those bits indicated by the mask and XOR the new mark into the result (behaves like iptables -j MARK --set-xmark). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Linux kernel-style for compilation messagesPablo Neira Ayuso2011-03-151-0/+3
| | | | | | | | | | | | [...] CC external_inject.o CC internal_cache.o CC internal_bypass.o CC read_config_yy.o CC read_config_lex.o CCLD conntrackd Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: bump version to 1.0.0conntrack-tools-1.0.0Pablo Neira Ayuso2011-02-271-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: prepare 1.0.0 release in conntrack-tools manualPablo Neira Ayuso2011-02-271-2/+1
| | | | | | | Remove reference which states that this is still under development and refer to version 1.0.0. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: conntrack-tools now requires libnetfilter_conntrack >= 0.9.1Pablo Neira Ayuso2011-02-241-1/+1
| | | | | | | The existing code requires new features that went into the current library version. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add missing conntrackd -s invocation with optionsPablo Neira Ayuso2011-02-221-1/+5
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add reference to the CT target againPablo Neira Ayuso2011-02-221-0/+27
| | | | | | | Now that we have fixed several aspects of the event filtering in 2.6.38, I reintroduce the documentation for this feature. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: support SYN_SENT2 TCP state as --state parameterPablo Neira Ayuso2011-02-221-2/+7
| | | | | | | | Since Linux kernel 2.6.31, the LISTEN state is SYN_SENT2. With this patch, we allow to use -p tcp --state SYN_SENT2 which was not possible so far. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: display informative message if expectation table is flushedPablo Neira Ayuso2011-02-221-0/+2
| | | | | | | | | | | With this patch, we display the following message after: # conntrack -F expect conntrack v0.9.15 (conntrack-tools): expectation table has been emptied. To make it consistent with the message displayed with conntrack -F. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: document redundant link support for conntrackdPablo Neira Ayuso2011-02-181-0/+39
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: document -s option of conntrackd in the manualPablo Neira Ayuso2011-02-181-0/+115
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: remove use of deprecated nfct_maxsize()Pablo Neira Ayuso2011-02-182-11/+16
| | | | | | | This patch removes the use of nfct_maxsize() and several abusive stack-based allocations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: allocate template objects in the heapPablo Neira Ayuso2011-02-171-61/+89
| | | | | | | | | | With this patch, we don't abuse the stack anymore, instead we allocate the template objects that are used in the heap. We stop using nfct_maxsize() which is now deprecated in libnetfilter_conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: use nfct_copy() with override flag in cache_object_new()Pablo Neira Ayuso2011-02-171-1/+1
| | | | | | | | | Using memcpy() is not safe, it breaks secctx and it may break more things in the future. Moreover, nfct_size*() functions will be deprecated soon, they are evil since they open the window to memcpy(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add -o ktimestamp option (it requires linux >= 2.6.38)Pablo Neira Ayuso2011-02-172-4/+12
| | | | | | | | | | | | | | | | | | | | | | | This option requires Linux kernel >= 2.6.38, you have to enable conntrack timestamping with: echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp # conntrack -L -o ktimestamp udp 17 59 src=192.168.1.128 dst=192.168.1.1 sport=52050 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=52050 [ASSURED] mark=0 delta-time=121 [start=Thu Feb 17 17:41:18 2011] use=1 # conntrack -L conntrack v0.9.15 (conntrack-tools): 20 flow entries have been shown. udp 17 31 src=192.168.1.128 dst=192.168.1.1 sport=52050 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=52050 [ASSURED] mark=0 delta-time=149 use=1 # conntrack -E -o ktimestamp ... [DESTROY] udp 17 src=192.168.1.128 dst=192.168.1.1 sport=40162 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=40162 [ASSURED] delta-time=3 [start=Thu Feb 17 17:44:57 2011] [stop=Thu Feb 17 17:45:00 2011] # conntrack -E [DESTROY] udp 17 src=192.168.1.128 dst=77.226.252.14 sport=123 dport=123 src=77.226.252.14 dst=192.168.1.128 sport=123 dport=123 delta-time=8 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: rise number of committed entries per stepPablo Neira Ayuso2011-02-161-1/+1
| | | | | | | | | | | This patch rises the number of committed entries per step from 64 to 8192. Experimental results in active-active setups here show that we reduce the commit time with this value significantly. This deserves some more study, it can be a good idea to remove this commit per step completely. I leave this for the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>