summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* conntrackd: Disable runtime systemd support by defaultPablo Neira Ayuso2016-02-176-18/+12
| | | | | | | | | | | | By default, conntrackd is compiled with no built-in systemd support. This patch updates the default runtime behaviour to be consistent with what ./configure provides by default. Thus, users should explicitly indicate "Systemd On" in their configuration file to enable this. This shouldn't cause any problem to old users of conntrackd. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: add tests for CIDR notationAsbjørn Sloth Tønnesen2016-02-162-0/+6
| | | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for CIDR notationAsbjørn Sloth Tønnesen2016-02-162-5/+85
| | | | | | | | | | | | | | Add support for using CIDR notation in --{orig,tuple}-{src,dst} arguments, instead of free-form formatting netmask in --mask-{src,dst}. Example: conntrack -L -s 2001:db8::/56 Instead of: conntrack -L -s 2001:db8:: --mask-src ffff:ffff:ffff:ff00:: Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: extend parse_addr() with CIDR supportAsbjørn Sloth Tønnesen2016-02-161-7/+28
| | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk>
* conntrack: split up nfct_set_addr_from_opt()Asbjørn Sloth Tønnesen2016-02-161-13/+20
| | | | | | | | | Prepare for CIDR support, by splitting nfct_set_addr_from_opt() into nfct_parse_addr_from_opt() for parsing and nfct_set_addr_opt() for storing. Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: add netmask testsAsbjørn Sloth Tønnesen2016-02-082-0/+8
| | | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for netmask filteringAsbjørn Sloth Tønnesen2016-02-082-15/+150
| | | | | | | | This patch extends --mask-src and --mask-dst to also work with the conntrack table, with commands -L, -D, -E and -U. Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: cleanup: use switch statements for family checksAsbjørn Sloth Tønnesen2016-02-011-8/+16
| | | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: consolidate filteringAsbjørn Sloth Tønnesen2016-02-011-37/+20
| | | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: support delete by labelAsbjørn Sloth Tønnesen2016-02-012-1/+4
| | | | | | | | | | | This option was already silently allowed by 991fc4ae, but didn't have any effect. This patch adds the check and documents it. Cc: Clemence Faure <clemence.faure@sophos.com> Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: use local conntrack binaryAsbjørn Sloth Tønnesen2016-02-011-1/+1
| | | | | | | | | | The binary under test should be the one, this ensures that it is in sync with the tests performed, and that users who build from source, can test the binary prior to `make install`. Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: ignore dot files in testdirAsbjørn Sloth Tønnesen2016-02-011-0/+3
| | | | | | | Got tired of having to exit the editor, before testing. Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: flush stdout to keep syncAsbjørn Sloth Tønnesen2016-02-011-0/+1
| | | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: run testfiles in the correct orderAsbjørn Sloth Tønnesen2016-02-011-4/+10
| | | | | | | | | Use scandir(3) instead of opendir(3), so that the tests are run in the expected order, otherwise it doesn't make sense to prefix the testfiles with a two digit number, giving the impression that they are run in order. Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk>
* conntrack: fix expectation entry creationAsbjørn Sloth Tønnesen2016-01-191-2/+4
| | | | | | | | | | | | | Store tuple-src and tuple-dst in exptuple, as used by the EXP_CREATE case. Verified with doc/cli/test.sh Also reorder the cases, so the netmask case is last. Reported-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "conntrack: fix expectation entry creation"Asbjørn Sloth Tønnesen2016-01-191-2/+0
| | | | | | | | | | {} is mask-src and mask-dst, [] is tuple-src and tuple-dst mask-* should be stored in mask, tuple-* should be stored in exptuple. This reverts commit 3309fdb4413cb32f9b95e05064dc9dbb56550939 since it mixed up {} and []. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack-tools: add conntrackd.conf(5) manpageArturo Borrero2015-11-233-4/+1079
| | | | | | | | | | This new manpage describes all the configuration options of the conntrackd.conf file. While at it, point conntrackd(8) to this new manpage. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix build with musl libcRodrigo Rebello2015-11-231-0/+1
| | | | | | | | | | | | | | The GNU version of 'struct tcphdr' is not exposed by musl libc headers unless _GNU_SOURCE is defined. Without this definition, the build fails with: rpc.c: In function 'rpc_helper_cb': rpc.c:351:15: error: 'struct tcphdr' has no member named 'doff' offset += th->doff * 4; ^ Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add systemd supportArturo Borrero2015-11-1714-3/+183
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds basic systemd support. The feature can be enabled/disabled at configure time: ./configure --disable-systemd Also, at runtime in conntrackd.conf General { Systemd on|off } (by default it's enabled both at runtime and at configure time) * tell systemd about conntrackd readiness: When conntrackd starts, it will send systemd the data "READY=1". At the point the data is sent, conntrackd is fully ready to work (configuration was OK, sockets OK, et all), so other actions depending on conntrackd can be safely chained in the machine boot process. * tell systemd about conntrackd shutting down: If the admin kills conntrackd with `conntrackd -k', the data "STOPPING=1" will be send to systemd so it learns about the daemon shutting down. Same for manual signals. * watchdog support: The admin can configure systemd to watch the conntrackd daemon and perform some actions if conntrackd dies: restart it, reboot the machine, etc... Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure.ac: improve feature selectionArturo Borrero2015-11-011-2/+2
| | | | | | | | Let's improve feature selection with feedback from Jan Engelhardt and Pablo Neira Ayuso. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add zone direction supportDaniel Borkmann2015-09-294-27/+70
| | | | | | | | | | | | | | | | This patch adds support for zone directions. Since all options have the orig/reply as a prefix, I named it --orig-zone and --reply-zone to stay consistent with the rest of the cmdline options. As for the option chars, there was no unallocated reasonable combination, thus only long options are officially exposed in the help, similarly as in other cases. Test suite results, after patch: OK: 79 BAD: 0 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack-tools 1.4.3 releaseconntrack-tools-1.4.3Pablo Neira Ayuso2015-09-081-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: update syntax in documentationPablo Neira Ayuso2015-09-084-7/+7
| | | | | | | Since dd73ceecdbe8 ("nfct: Update syntax to specify command before subsystem") the command comes before the object type. Update documentation accordingly. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: Update syntax to specify command before subsystemPablo Neira Ayuso2015-08-2615-169/+225
| | | | | | | | | | | | | | | | | This patch gets the nfct syntax in sync with nft so it looks like this: nfct <add|delete|...> object ... instead of: nfct object <add|delete|...> ... This patch retains backward compatibility so you can still use the old syntax. The manpage and tests have been also updated to promote the adoption of this syntax. We should have little existing clients of this tool as we can only use this to configure the cttimeout and cthelper infrastructures. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: fix run-test.shPablo Neira Ayuso2015-08-261-2/+2
| | | | | | | | | | This reports: run-test.sh: line 3: UID: read-only variable rename it to _UID. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: don't link against libnetfilter_conntrackArturo Borrero2015-08-261-1/+0
| | | | | | | | | | | | The nfct program uses none of the symbols of libnetfilter_conntrack. Linking against it means that distributors have to maintain an useless depedency. This was spotted by the dpkg-shlibdeps tool. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc/debian.conntrackd.init.d: drop fileArturo Borrero Gonzalez2015-08-261-48/+0
| | | | | | | | | | This file is likely dead code. It's outdated. Also I think distributors should manage themselves to integrate daemons in their operating systems. Following this idea, this file doesn't belong here. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* list: fix prefetch dummyArturo Borrero Gonzalez2015-08-261-1/+1
| | | | | | | | | | | | | | | | | [...] CC conntrack.o In file included from ../include/conntrack.h:4:0, from conntrack.c:41: conntrack.c: In function ‘findproto’: ../include/linux_list.h:385:59: warning: right-hand operand of comma expression has no effect [-Wunused-value] for (pos = list_entry((head)->next, typeof(*pos), member), \ ^ [...] The original patch is from Patrick McHardy <kaber@trash.net>. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: missing break in expectation message parser functionPablo Neira Ayuso2015-08-181-1/+3
| | | | | | | Fortunately, the TLVs come in order in the message, however, if the order is changed we'll incorrectly set up the expectation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: use strncpy to set up the cache namePablo Neira Ayuso2015-08-181-2/+3
| | | | | | | This is not exposed, but use the strncpy() variant to calm down static code validators. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: simplify branch in tcp_accept()Pablo Neira Ayuso2015-08-181-7/+5
| | | | | | The same code is executed regardless the reason why accept() has failed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix error handling in nfq_queue_cb()Pablo Neira Ayuso2015-08-182-15/+16
| | | | | | | Make sure we have a clean exit on error, everything needs to be properly released. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix descriptor leak in do_local_request()Pablo Neira Ayuso2015-08-181-2/+5
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix leak in fork_process_new()Pablo Neira Ayuso2015-08-181-0/+2
| | | | | | Release the child_process structure in case that fork() fails. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: NTA_MAX is also an invalid attributePablo Neira Ayuso2015-08-181-1/+1
| | | | | | Otherwise this can result in an off-by-one array access. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix sanitization of expection attribute in the wire formatPablo Neira Ayuso2015-08-181-1/+1
| | | | | | The maximum number of attribute is NTA_EXP_MAX for expectation sync messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: made the protocol option value case insensitiveSzilárd Pfeiffer2015-07-031-1/+1
| | | | | | | | | Extensions register protocols by lowercase protocol name, but value of proto command line option may be uppercase. Extension related options cannot be used when protocol name comparision fails. Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix expectation entry creationSzilárd Pfeiffer2015-06-261-0/+2
| | | | | Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: refactor handling of address optionsSzilárd Pfeiffer2015-06-261-37/+32
| | | | | Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: don't overwrite read-only shell variablePablo Neira Ayuso2015-06-261-1/+0
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cthelper: Optimise nfq_queue_cbPaul Aitken2015-06-121-5/+3
| | | | | | | | ct and myct have both already been checked for non-NULL, so there's no need to check either of them again later. Signed-off-by: Paul Aitken <paitken@brocade.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: remove unused 'numbytes'Paul Aitken2015-06-121-2/+1
| | | | | | | 'numbytes' isn't used and can be removed. Signed-off-by: Paul Aitken <paitken@brocade.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: Fix wrong memset usagePablo Neira Ayuso2015-05-291-17/+6
| | | | | | | | memset fills bytes, not ulongs - so the second parameter (the fill value) has to be a byte. Reported-by: Paul Aitken <paitken@brocade.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cthelper: don't pass up a 0 length queueChas Williams III2015-05-211-1/+4
| | | | | | | | | If the user didn't specify a queue length in the configuration file it will have a length of 0. Allow the kernel's default to take precedence instead. Signed-off-by: Charles (Chas) Williams <ciwillia@brocade.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Use <fcntl.h> instead of legacy synonym <sys/fcntl.h>Felix Janda2015-05-211-1/+1
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Define _GNU_SOURCE to get members of tcphdr&ucphdrFelix Janda2015-05-214-0/+4
| | | | | | | | | The source uses linux names for members of tcphdr. For example "source" instead of "th_sport", ... musl libc's headers need _GNU_SOURCE defined in order to expose these. Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Include <sys/select.h> for fd_setFelix Janda2015-05-213-0/+3
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Use stdint typesFelix Janda2015-05-2116-28/+28
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Sync with kernel headersFelix Janda2015-05-212-42/+17
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure: Add AM_PROG_AR to silence automake warningFelix Janda2015-05-211-0/+1
| | | | | | | | | /usr/share/automake-1.13/am/ltlibrary.am: warning: 'ct_helper_tns.la': linking libtool libraries using a non-POSIX /usr/share/automake-1.13/am/ltlibrary.am: archiver requires 'AM_PROG_AR' in 'configure.ac' src/helpers/Makefile.am:3: while processing Libtool library 'ct_helper_tns.la' Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>