summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* conntrackd: bump version to 0.9.8conntrack-tools-0.9.8Pablo Neira Ayuso2008-10-211-1/+1
| | | | | | This patch bumps the version to 0.9.8 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add missing information on -t to the helpPablo Neira Ayuso2008-10-211-2/+3
| | | | | | | This patch adds missing information on -t when conntrackd is invoked with -h. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update conntrackd manpagePablo Neira Ayuso2008-10-211-5/+12
| | | | | | | This patch updates the conntrackd manpage some re-writes, missing options and new dependencies. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: remove example about CacheWriteTroughPablo Neira Ayuso2008-10-213-27/+0
| | | | | | | | | | | | | | | This patch removes the documentation about the CacheWriteTrhough clause. This feature is scheduled for removal since the asynchronous nature of conntrackd does not allow multi-path routing support. I'm lying, actually there's a chance to support it, but we have to guarantee that the RTT in the message synchronization between the firewall is smaller than the RTT between the peer and the firewalls. Moreover, this option has made more bad than good since people enable it when things don't work. Making the whole troubleshooting more complicated. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: do not filter in user-space if kernel supports BSFPablo Neira Ayuso2008-10-214-8/+9
| | | | | | | | | This patch avoids a double filtering in user-space and kernel-space if the kernel support BSF. Since we do not use BSF for dumps and resyncs, we add a new parameter to ignore_conntrack to indicate if we have to perform the filtering in user-space or not. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: use jhash2 instead of double jhash+jhash_2wordsPablo Neira Ayuso2008-10-211-19/+17
| | | | | | | | Currently, oprofile reports ~17% of sample in the hashing. With this patch, that uses jhash2 instead of a double call to jhash and one to jhash_2words, it goes down to ~11%. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: fix segfault if the Filter clause is unusedPablo Neira Ayuso2008-10-211-1/+2
| | | | | | | This patch fixes a segfault when conntrackd -k is invoked for an instance of conntrackd with no use of the Filter clause. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: report when kernel-space event filtering is in usePablo Neira Ayuso2008-10-211-0/+1
| | | | | | | This patch adds a log message to tell that conntrackd are using kernel-space filtering. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: rise default size of the hashtable in the example filePablo Neira Ayuso2008-10-203-6/+6
| | | | | | | This patch rises the default value of the hashtables in terms of buckets and entries to the default value in nf_conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* notrack: fix double receival of resync requestsPablo Neira Ayuso2008-10-201-0/+21
| | | | | | | This patch fixes double insertion in the tx_list if we receive two (or more) consecutive resync request in short time. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* config: fix usage of 'PurgeTimeout' in Sync NOTRACKPablo Neira Ayuso2008-10-201-2/+4
| | | | | | | | | This patch fixes a problem that is reported by conntrackd while trying to parse the example configuration file. We fix this instead of the example file to make it consistent with other replication approaches. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache-iterators: improve committingPablo Neira Ayuso2008-10-201-4/+16
| | | | | | | | | | | | | This patches fixes two problems: - If we failt to update an entry, we remove it and try again. This happens when we still have an entry in a final state like TIME_WAIT while we see a new connection (SYN_SENT) with the same tuple. In this particular case, we fail to update since some status bits are only settable, but not unsettable. - If we hit ETIME in an update, we have to go over the creation patch, otherwise we hit ENOENT in the next run. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: fix update of scheduled-to-timeout entriesPablo Neira Ayuso2008-10-201-44/+55
| | | | | | | This patch fixes a problem that allows the update of entries that are scheduled to be removed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: cleanup for NAT filteringPablo Neira Ayuso2008-10-161-24/+9
| | | | | | | | | | This patch cleanups the NAT filtering. The former code had three branches, one if src and dst NAT are set, else one if src NAT is set, else one if dst NAT is set. Now, we check if src NAT is set or if dst NAT is set. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update INSTALL filePablo Neira Ayuso2008-10-131-148/+11
| | | | | | | | | This patch updates the INSTALL file. Now it only describes the compilation and installation of the conntrack-tools. For further information, we refer to the user manual that is available under doc/manual. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* manual: add initial user manualPablo Neira Ayuso2008-10-134-0/+634
| | | | | | This patch adds the manual in docbook format to the conntrack-tools. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix dump counter displayed with -L expectPablo Neira Ayuso2008-10-091-0/+1
| | | | | | This patch fixes the dump counter displayed with -L expect. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix filtering for unsupported protocolPablo Neira Ayuso2008-10-045-18/+89
| | | | | | | | | This patch fixes filtering for unsupported protocol. Thus, you can use -L -p 47 or -L -p gre to filter `gre' traffic. Based on an initial patch from Bryan Duff <bduff@astrocorp.com>. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix mark-based filtering for event displayPablo Neira Ayuso2008-10-021-3/+6
| | | | | | | | | | | The mark-based filtering for events does not work if the mark is not present in the event message. This happens because nfct_cmp() skips the comparison of the compared objects since it they do not have the same attributes set. This patch make use of the new NFCT_CMP_MASK flag that returns false if the first object passed as parameter is set and the second is not. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: cleanup XML header handlingPablo Neira Ayuso2008-09-282-28/+6
| | | | | | | This patch removes the use of snprintf and directly print the XML header to the standard output. This simplifies the handling. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: cleanup for the update pathPablo Neira Ayuso2008-09-281-4/+5
| | | | | | This patch cleans up the update path for the conntrack utility. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ftfw: reset window and flush the resend queue during helloingPablo Neira Ayuso2008-09-251-1/+21
| | | | | | | | | | | | | This fixes two bugs when a hello message is received: * We can create malformed nack messages during the helloing. We have to reset the acknowlegdment window, otherwise we may create malformed nack messages. * We have to empty the resend list/queue when a hello message is received, otherwise the entries get stuck to the resend queue once the sequence number wraps around. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ftfw: fix race condition in the helloing routinePablo Neira Ayuso2008-09-252-20/+30
| | | | | | | | | | | | | | | | | | | | This patch fixes a race condition that can prevent one node from sending the initial hello message required to reset the sequence tracking. node A node B | | start | | hello msg |----------------------->| stop | | start | | |<-----------------------| hello-back msg In the picture above, the node A never sends the hello messages. Thus, the node B drops the next messages as they are in the before boundary. This patch adds a new state to the the helloing state-machine to fix this problem. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ftfw: fix race that triggers a double insertion into tx_listPablo Neira Ayuso2008-09-251-2/+9
| | | | | | | | This patch fixes a race condition that can trigger a double insertion to the tx_list. This happens if we receive two resync request very close or resync just after a nack or vice-versa. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fix: remove node from tx_list when the state-entry is destroyPablo Neira Ayuso2008-09-211-6/+9
| | | | | | | | | This patches fixes a race that triggers a read-after-free access to the tx_list. The state-entry is destroyed but it is still in the list. The fix removes the state-entry from the tx_list in the destroy path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* config: use /var/run to create the UNIX socket filePablo Neira Ayuso2008-09-184-4/+4
| | | | | | | | This patch removes the use of /tmp to create the UNIX socket file to communicate with conntrackd in the example configuration files. This was OK in the early alpha days, but not anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cleanup: remove some debug messages from sync-ftfw.cPablo Neira Ayuso2008-09-171-31/+8
| | | | | | | Remove useless debug messages, now we have a pluging for tcpdump to debug the FT-FW protocol. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: check if kernel-space filtering is availablePablo Neira Ayuso2008-09-173-10/+12
| | | | | | | | Check if the Linux kernel is >= 2.6.26, otherwise it does not support kernel-space filtering. This is not clean but we have no choice, the BSF infrastructure does not return ENOTSUPP for unsupported operations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cleanup: Linux kernel version checkingPablo Neira Ayuso2008-09-171-6/+1
| | | | | | | Minor cleanup to save a couple of lines in the Linux kernel version checking. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: fix NAT detection tweakPablo Neira Ayuso2008-09-162-18/+3
| | | | | | | | With this patch, we rely on the real source and destination of the packet to perform the filter. The current NAT detection tweak is broken for certain situations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ftfw: check for malformed ack and nack messagesPablo Neira Ayuso2008-09-161-0/+8
| | | | | | | This patch checks that the [from, to] interval of ack and nack messages is OK. In other words, we check that: to >= from Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* compilation: relax too strict warning checkingPablo Neira Ayuso2008-08-151-1/+0
| | | | | | | | | | This patch removes the -Werror option during the compilation. Some users have reported problems related to the code generated by flex and bison. This results in useless reports and a bad experience for end-users. Ideally, it would be great to have something like 'autoconf prettify' for less verbose output. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: insert `conntrack-tools' string in help and error messagesPablo Neira Ayuso2008-08-121-4/+4
| | | | | | | Insert string `conntrack-tools' in error messages to explicitly print that this version is inside the conntrack-tools package. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: check for missing arguments in getopt_longPablo Neira Ayuso2008-08-121-7/+13
| | | | | | | | | From: Pablo Neira Ayuso <pablo@netfilter.org> If getopt_long returns '?', show an error telling that some arguments are missing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: remove unrequired \n in error messagePablo Neira Ayuso2008-08-121-1/+1
| | | | | | Remove extra \n in error message. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: remove duplicated optarg checkingPablo Neira Ayuso2008-08-121-36/+0
| | | | | | | Remove duplicated optarg checkings for options that require mandatory paramaters. This checking is already done by getopt_long(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: avoid errors related to the expected bit handlingPablo Neira Ayuso2008-08-071-2/+15
| | | | | | | | We hit error if we try to change the expected bit for already existing conntracks. On the other hand, if the conntrack does not exist, do not change the expected bit, otherwise we also hit error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache iterators: commit master entries before related onesPablo Neira Ayuso2008-08-073-5/+50
| | | | | | Commit master entries before related ones to avoid ENOENT errors. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache iterators: rework cache_reset_timersPablo Neira Ayuso2008-08-0710-21/+71
| | | | | | | | | | | This patch adds the clause PurgeTimeout that sets the new timer when conntrackd -t is called. This command is particularly useful when the sysadmin triggers hand-overs between several nodes without rebooting as it reduces the timers of the remaining entries in the kernel. Thus, avoiding clashes between new and old entries that may trigger INVALID packets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: add getter and check existence functionsPablo Neira Ayuso2008-08-074-2/+36
| | | | | | | | | | This patch adds nl_get_conntrack and it changes the behaviour of nl_exist_conntrack. Now, nl_get_conntrack requests the kernel for a conntrack and updates the cached entry. On the other hand, nl_exist_conntrack only inquiries for the existence of the entry. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* script: yet another minor fixPablo Neira Ayuso2008-08-041-1/+1
| | | | | | Minor fix for the primary-backup.sh script Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache_iterators: do not report ENOENT in cache_reset_timersPablo Neira Ayuso2008-08-021-1/+0
| | | | | | | | | | Do not report ENOENT to log files, this may confuse users. There's a race condition when shortening the timers and handling the destroy messages. However, this problem is not serious as the point of the shortening is to reduce the lifetime of the conntracks. If the conntrack is dying, there's no point to shorten their lifetime anymore :) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* script: fix broken if branchesPablo Neira Ayuso2008-08-021-0/+10
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fix missing updates in the example filesPablo Neira Ayuso2008-08-022-3/+4
| | | | | | Fix missing updates in keepalived.conf and primary-backup.sh Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add -t option to shorten conntrack timeoutsPablo Neira Ayuso2008-08-025-0/+48
| | | | | | | | | | | | | | | | | This patch adds the new option `-t' for conntrackd. This option shortens the value of the timeout for the cached entries that lives in the kernel. This option is particularly useful to remove the zombie established entries that remain in kernel if the user tests the platform by forcing the takeover from one to another node several times. We currently use the value of CommitTimeout which is sane for it. Adding a new option does not seem to add more flexibility IMO. Once we get the patches to notify user changes via ctnetlink and the netlink flag NLM_F_ECHO works, we may directly invoke a massive purge of the entries, however, such solution would still need evaluation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* script: rework scripts that enable interaction with keepalivedPablo Neira Ayuso2008-08-0210-104/+100
| | | | | | | | | | | This patch reworks the documentation section. It removes the replicated keepalived.conf files and merge all the scripts into one to reduce confusion and improve maintainability. It's likely that the documentation directory will suffer more restructurations in the near future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: remove duplicated example filesPablo Neira Ayuso2008-08-0112-632/+108
| | | | | | | | This patch removes the directories node1/ and node2/ since the differences are few small and the user should be able to get it running if he RTFM. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ftfw: show consistent information to users for problem diagnosingPablo Neira Ayuso2008-08-014-9/+28
| | | | | | | | | | This patch hides information that may confuse users while they are diagnosing problems in their setup. For example, we hide entries that are schedule to expire - from the user side, they are already destroyed entries; and we show in the counters the real active entries, not all that are stored in the caches. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fix broken normal deletion in cachesPablo Neira Ayuso2008-08-013-42/+42
| | | | | | | | | | | | This patch fixes the non-timer-based cache deletion. This bug affects the alarm-based approach since the backup replicas did not get the deletion event, thus, delaying the deletion. This patch introduces cache_find() to look up for a conntrack object and __cache_del_timer() to perform direct deletions by means of the pointer obtained with cache_find(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fix: wrong use of timersub in cache_timerPablo Neira Ayuso2008-08-011-1/+1
| | | | | | Fix wrong output in the dump of the expire timer which was negative. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>