summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* conntrackd: document internal cache disabling and TCP-based synchronizationPablo Neira Ayuso2009-12-232-4/+61
| | | | | | | | This patch documents the internal cache disabling feature that is available for the NOTRACK mode. I have also added an example on how to set up a TCP-based state-synchronization. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix flow-state filtering for TCPPablo Neira Ayuso2009-12-231-1/+4
| | | | | | | | This patch fixes the clause `State' in `Filter' that allows you to filter by protocol state. This bug was introduced during the implementation of the TCP-based synchronization. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add ICMP support for state-synchronizationPablo Neira Ayuso2009-12-196-1/+29
| | | | | | | | This patch adds state-synchronization for ICMP. You SHOULD use a Linux kernel >= 2.6.31, otherwise this patch can result in tons of state-updates. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: use indirect call to build layer 4 protocol informationPablo Neira Ayuso2009-12-191-10/+43
| | | | | | | With this patch, we use an indirect call to build the layer 4 information into the synchronization message. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add `DisableInternalCache' clausePablo Neira Ayuso2009-10-2114-234/+572
| | | | | | | | This patch adds the clause `DisableInternalCache' that allows you to bypass the internal cache. This clause can only be used with the notrack synchronization mode. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add missing external statisticsPablo Neira Ayuso2009-10-141-1/+11
| | | | | | | In 0b03f4b759e439edd2c3da0add08050276d7dc5f, I forgot to increase the stats for successful cases. This patch fixes this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add statistics when the external cache is disabledPablo Neira Ayuso2009-10-141-5/+31
| | | | | | | | | | # conntrackd -s external inject: connections created: 0 failed: 0 connections updated: 0 failed: 0 connections destroyed: 0 failed: 0 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use fscanf() instead of read() for showing counterHannes Eder2009-10-081-7/+6
| | | | | | | | | | Read an integer right away with fscanf() instead of read()-ing to a buffer, which was actually to small for the terminating '\0', and atoi()-ing. Furthermore read() might not read enough, though unlikely here. Signed-off-by: Hannes Eder <heder@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: avoid error with expectations when using 'conntrack -E -e ALL ...'Hannes Eder2009-10-081-1/+2
| | | | | | | | | | | | | | | Avoid this error: conntrack v0.9.13 (conntrack-tools): Operation failed: No such file or directory when using 'conntrack -E -e ALL ...'. This is caused by the fact that netfilter expectations also get delivered, but things are not setup for this, nfnl_catch returns -1 and errno = ENOENT. Signed-off-by: Hannes Eder <heder@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix output when no arguments are passedHannes Eder2009-10-071-1/+1
| | | | | | | | When 'conntrack' is called with no arguments then garbage is printed after the usage message. This patch fixes this. Signed-off-by: Hannes Eder <heder@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix wrong calculation of new maxfd on unregister_fds()Pablo Neira Ayuso2009-09-261-0/+2
| | | | | | | | This patch fixes a missing calculation of maxfd when a file descriptor is unregistered. Reported-by: Jean Mickael Guerin <jean-mickael.guerin@6wind.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add alive control messages to notrack modePablo Neira Ayuso2009-09-231-0/+39
| | | | | | | | This patch adds the alive control message to the notrack mode. This helps to diagnose problems in the synchronization and the state of the channel, specifically for TCP-based channels. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add retention queue for TCP errorsPablo Neira Ayuso2009-09-237-11/+144
| | | | | | | | Under stress, the TCP stack may return EAGAIN if there is not space left in the sender buffer. We also enqueue any other error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: rate-limit the amount of connect() callsPablo Neira Ayuso2009-09-231-0/+14
| | | | | | | | This patch rate-limits the amount of connect() calls to avoid syn-floods when the other peer is not connected and we are generating updates. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: break lines at 80 characters in example config filesPablo Neira Ayuso2009-09-232-16/+18
| | | | | | | In 49540362b2a25aadbaf25fd087414776aa5a67a8, we forgot to break lines at 80 characters. This patch cleans up this issue. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix re-connect with multiple TCP channelsPablo Neira Ayuso2009-09-232-5/+6
| | | | | | | | This patch fixes a bug in the TCP support that breaks re-connections of the client side if several TCP channels are used in the configuration file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix `conf' local variable in channel.c that shadows globalPablo Neira Ayuso2009-09-211-11/+11
| | | | | | | This patch avoids the shadowing of the global `conf' variable that is used to store the configuration information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: improve error handling in tcp_sendPablo Neira Ayuso2009-09-211-1/+4
| | | | | | | | | | | | With this patch, we increase the error stats if: * we failed to connect to the other peer. * some unexpected error made connect() fail. * sendto returned ECONNRESET or EPIPE. Moreover, we propagate the sendto() errors to upper layers under failure as Samuel Gauthier suggested. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix return value in notrack_local()Pablo Neira Ayuso2009-09-171-1/+1
| | | | | | | | | | In 9406f29b89f6727c3db5485d109466701393b4d4, we added different return values for the UNIX sockets that we use to extract the daemon statistics. Unfortunately, I forgot to change this as well. This patch fixes a problem that blocks the client socket indefinitely. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix MTU for TCP channelsPablo Neira Ayuso2009-09-115-5/+8
| | | | | | | | Use the TCP header size (20 bytes) instead of the UDP header size (8 bytes) to calculate the maximum packet size. Reported-by: Samuel Gauthier <samuel.gauthier@6wind.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix bad configuration file for DisableExternalCache statementSamuel Gauthier2009-09-032-24/+26
| | | | | | | | DisableExternalCache is supposed to be put in mode NOTRACK{} or Mode FTFW{} statement. Signed-off-by: Samuel Gauthier <samuel.gauthier@6wind.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: better parse_payload protection against corrupted packetsSamuel Gauthier2009-09-031-0/+2
| | | | | | | | | As we get attr->nta_attr directly from net message, it can be corrupted. Hence, we must check that nta_attr value is valid before trying to reach h[attr->nta_attr] element. Signed-off-by: Samuel Gauthier <samuel.gauthier@6wind.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: net message memory allocation is unsafePablo Neira Ayuso2009-09-031-1/+1
| | | | | | | | | | We cannot assume that we will not write in the net message before we send it, because the memory allocated for the net message (__net) is only reserved in BUILD_NETMSG (because of the { } block in it). This patch marks the buffer as static to avoid this problem. Based on a patch from Samuel Gauthier <samuel.gauthier@6wind.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add support state-replication based on TCPPablo Neira Ayuso2009-08-2317-17/+954
| | | | | | | | This patch adds support for TCP as protocol to replicate state-changes between two daemons. Note that this only makes sense with the notrack mode. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: allow to remove file descriptors from setPablo Neira Ayuso2009-08-212-0/+55
| | | | | | | With this patch, we can remove file descriptors dinamically from our own file descriptor pool. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: reduce the number of gettimeofday() syscallsPablo Neira Ayuso2009-08-218-7/+50
| | | | | | | | This patch reduces the number of gettimeofday syscalls by caching the current time in a variable at the beginning of the main loop. Based on a suggestion from Vincent Jardin. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add `DisableExternalCache' clausePablo Neira Ayuso2009-08-1912-43/+375
| | | | | | | | | | | This patch adds the clause `DisableExternalCache' that allows you to disable the external cache and to directly inject the entries into the kernel conntrack table. As a result, the CPU consumption of conntrackd increases. This clause can only be used with the FT-FW and the notrack synchronization modes, but not with the alarm mode. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: more robust sanity checking on synchronization messagesPablo Neira Ayuso2009-08-171-3/+8
| | | | | | | | This patch fixes an infinite loop that can occur if a message of zero length is received. Moreover, now we always stop the processing if the message is malformed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix crash for unubuffered channel on exit pathPablo Neira Ayuso2009-08-141-0/+3
| | | | | | | | This patch fixes a crash in the exit path for channels that are not buffered (no CHANNEL_F_BUFFERED flag set). This fix does not affect any existing channel in the tree. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: use conntrack ID in the cache lookupPablo Neira Ayuso2009-07-211-1/+3
| | | | | | | | | | | | This patch adds the conntrack ID to the comparison that is made in the lookup of entries that are stored in the cache. For old kernels, this field is set to zero for all entries so this patch does not make any difference. For recent kernels, this allows to keep two entries with the same tuple and different IDs: this is possible if NetlinkEventsReliable is set on. Moreover, this patch is useful to test the reliable ctnetlink event delivery in 2.6.31 works fine. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add support for IPv6 kernel-space filtering via BSFPablo Neira Ayuso2009-07-217-1/+38
| | | | | | | This patch adds the missing support to filter IPv6 from kernel-space by means of the BSF API that libnetfilter_conntrack provides. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add clause to enable ctnetlink reliable event deliveryPablo Neira Ayuso2009-07-218-1/+57
| | | | | | | | This patch adds the NetlinkEventsReliable clause, this is useful to turn on reliable Netlink event delivery. This features requires a Linux kernel >= 2.6.31. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: reset event limit iteration counterPablo Neira Ayuso2009-07-191-0/+3
| | | | | | | | | With this patch, we reset the event iteration limit counter after we have performed an event handling run. Thus, every run loop always performs a maximum of EventIterationLimit event handling instead of keeping the old credits for the next run loop. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: improve handling of external messagesPablo Neira Ayuso2009-07-193-4/+21
| | | | | | | | | With this patch, a) we set the file descriptors for the synchronization channels as non-blocking, b) we perform more than one recv() call per select() signal on the socket and c) we limit the iteration to the value that EventIterationLimit has set. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: rework commit not to fork a child processPablo Neira Ayuso2009-07-195-37/+109
| | | | | | | | | | | | | | | This patch reworks the commit phase to avoid the forking. This is particularly useful in active-active setups in which one node has to commit the external cache while it is receiving new entries to be added in the external cache. This results in really high commit times due to the penalty of the copy-on-write that fork performs. The default number of steps in one run loop is limited to 64 by now. No option to tune this parameter is still available via the configuration file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add iterators with limited steps in hash and cache typesPablo Neira Ayuso2009-07-175-13/+31
| | | | | | | This patch adds cache_iterate_limit() and hashtable_iterate_limit() that allows to limit the iteration to given a number of states. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* local: add LOCAL_RET_* return values for UNIX sockets callbacksPablo Neira Ayuso2009-07-177-20/+26
| | | | | | | | This patch adds the LOCAL_RET_* return values. The return value LOCAL_RET_STOLEN which allows to leave a client socket open while waiting for an operation to finish. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: spell fix in conntrack(8) manpageJan Engelhardt2009-07-171-1/+1
| | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: update library version requirementsPablo Neira Ayuso2009-07-171-2/+2
| | | | | | This patch updates the library version requirements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: bump version to 0.9.13conntrack-tools-0.9.13Pablo Neira Ayuso2009-07-171-1/+1
| | | | | | This patch bumps conntrack-tools version to 0.9.13. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix English typo in documentationPablo Neira Ayuso2009-07-171-2/+2
| | | | | | | This is an update to commit 575fc906a302599cb9afeb136096dfd96bb57b17. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix wrong TCP handling in unused nl_update_conntrack()Pablo Neira Ayuso2009-06-211-1/+1
| | | | | | | | | | | This patch fixes an incorrect use of nfct_get_attr_u32() instead of nfct_get_attr_u8() to obtain the current TCP state. This patch also sets the IP_CT_TCP_FLAG_CLOSE_INIT for states >= TIME_WAIT. The function nl_update_conntrack() is currently unused so this fix does not resolve any pending issue. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix memory leak in cache_update_force()Pablo Neira Ayuso2009-06-211-1/+3
| | | | | | | | This patch fixes a memory leak in cache_update_force(). The problem occurs if the object does not exists in the cache and we fail to add it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add statistics for enospc errors in queuesPablo Neira Ayuso2009-06-202-2/+6
| | | | | | | This patch adds a new statistic field to count the number of enospc errors while adding new nodes to some queue. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add statistics about queue node objectsPablo Neira Ayuso2009-06-201-0/+7
| | | | | | This patch adds the statistics for queue node objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add `-s queue' to display queue statisticsPablo Neira Ayuso2009-06-206-2/+37
| | | | | | | | | | | | | | | | | | | | This patch re-introduces `-s queue' but now it displays generic queue statistics. # conntrackd -s queue active queue objects: 0 queue txqueue: current elements: 0 maximum elements: 2147483647 not enough space errors: 0 queue rsqueue: current elements: 72 maximum elements: 128 not enough space errors: 0 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add the name field to queuesPablo Neira Ayuso2009-06-204-4/+11
| | | | | | | | This patch adds the name field to identify the queue by means of a string. This patch is used by the next one that introduces per-queue statistics. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: rename `-s queue' option by `-s rsqueue'Pablo Neira Ayuso2009-06-204-6/+6
| | | | | | | This patch renames the statistics option that displays the content of the resend queue which is used by the ftfw mode. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use TLV format for SCTP/DCCP protocol informationPablo Neira Ayuso2009-06-123-64/+39
| | | | | | | | | | | | | | | | | | | In 400ae54438c4b85126f9fab0ae1dc067823b70f7, we added the SCTP support by means of a structure that was encapsulated in an TLV attribute. However, this structure didn't handle alignment and endianess issues appropriately. Similar problem was introduced in b808645ec71b7cc22cf5106b3d79625d07e6077c along with the DCCP support. This patch moves every field of this structure to independent attributes. I decided not to use nesting to make building and parsing more simple. Using TLV is a good idea, specially for DCCP and SCTP that are under development and that may include new fields and obsolete them in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add support to display statistics on existing child processesPablo Neira Ayuso2009-06-116-1/+37
| | | | | | | | | | This patch adds the ability to dump the list of existing child processes. In general, it would be hard to display one since child processes are generally forked for very specific tasks, like commit and flush operations, and they have very limited lifetime. However, this can be handy for debugging problems. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>