summaryrefslogtreecommitdiffstats
path: root/doc
Commit message (Collapse)AuthorAgeFilesLines
* doc: add cluster match scriptPablo Neira Ayuso2021-09-212-0/+441
| | | | | | | This patch adds a script (from 2010!) to set up an active-active setup with the cluster match. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: fix overlapping queue numbers in example filePablo Neira Ayuso2021-05-281-4/+4
| | | | | | | Userspace helpers cannot have overlapping queue number, update the example file to fix the existing overlap. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: manual: Document userspace helper configuration at daemon startupPablo Neira Ayuso2021-05-281-21/+21
| | | | | | Describe how to configure conntrackd using the new simple setup approach. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: Set up userspace helpers when daemon startsPablo Neira Ayuso2021-05-281-2/+12
| | | | | | | Add a new setting to allow conntrackd to autoconfigure the userspace helpers at startup. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: manual: general documentation revampPablo Neira Ayuso2020-06-071-81/+91
| | | | | | A quick revamp on the conntrack-tools manual which is aging a bit. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: manual: refer to nf_conntrack sysctlPablo Neira Ayuso2020-06-071-6/+5
| | | | | | | ip_conntrack sysctl entries are very old and available for backward compatibility reasons. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: manual: fix conntrack examplesPablo Neira Ayuso2020-06-071-14/+14
| | | | | | | | | > (1) The mark in the command line is '10', not '1'. > (2) The dport in the example is '993', not '3486' and not '34846'. ... text says "has been deleted"; but conntrack prints "have been deleted" Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* docs: refresh references to /proc/net/core/rmem_defaultArturo Borrero Gonzalez2019-10-303-3/+3
| | | | | | | | | | | In recent kernel versions, /proc/net/core/rmem_default is now /proc/sys/net/core/rmem_default instead. Refresh docs that mention this file. Reported-by: Raphaël Bazaud <rbazaud@gmail.com> Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: Add new SLP helperMichal Kubecek2019-07-221-0/+8
| | | | | | | | | | | | | | | | | | | Service Location Protocol (SLP) uses multicast requests for DA (Directory agent) and SA (Service agent) discovery. Replies to these requests are unicast and their source address does not match destination address of the request so that we need a conntrack helper. A kernel helper was submitted back in 2013 but was rejected as userspace helper infrastructure is preferred. This adds an SLP helper to conntrackd. As the function of SLP helper is the same as what existing mDNS helper does, src/helpers/slp.c is essentially just a copy of src/helpers/mdns.c, except for the default timeout and example usage. As with mDNS helper, there is no NAT support for the time being as that would probably require kernel side changes and certainly further study (and could possibly work only for source NAT). Signed-off-by: Michal Kubecek <mkubecek@suse.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* systemd: default to use libsystemd if build with support for itArturo Borrero Gonzalez2018-04-184-4/+4
| | | | | | | | | | | | | | We may assume that if an user does build conntrackd with such feature, is with the intention to use it. So, if that's the case, default to use it. This eases some downstream use cases when dealing with default configs to be shipped to final users. This could be a mid-point solution, given some users are asking for a full revert of commit c01d0d9138112ec95ee316385ea2687dd94fa4e3. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: reallocate cli testing scriptArturo Borrero Gonzalez2018-04-181-106/+0
| | | | | | | Move this to test/ Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: make the daemon run in RT mode by defaultArturo Borrero Gonzalez2017-06-125-103/+0
| | | | | | | | | | | | | | | | | | | | | | | In order to prevent netlink buffer overrun, conntrackd is recommended to run at max priority. Make conntrackd to use a RT (SHED_RR) scheduler by default at max priority. This is common among other HA daemons. For example corosync uses SCHED_RR by default. The scheduler configuration option is kept in order to allow admins to perform fine-tuning, but it is deleted from example configuration files. Note that this default sched priority is so high that it makes the nice value useless, so deprecate the nice configuration. Anyway the nice value can be set externally at runtime using nice/renice. The code is moved to the init() routine. In case of error setting the scheduler, the system default will be used. Report a message to the user and continue working. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: deprecate unix backlog configurationArturo Borrero Gonzalez2017-06-065-5/+0
| | | | | | | | | This configuration option doesn't add any value to users. Use the magic value of 100 (i.e, the socket will keep 100 pending connections), which I think is fair enough for what conntrackd can do in the unix socket. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: ssdp: Track UPnP eventingKevin Cernekee2017-02-121-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The UPnP Device Architecture spec provides a way for devices to connect back to control points, called "Eventing" (chapter 4). This sequence can look something like: 1) Outbound multicast M-SEARCH packet (dst: 1900/udp) - Create expectation for unicast reply from <any host> to source port 2) Inbound unicast reply (there may be several of these from different devices) - Find the device's URL, e.g. LOCATION: http://192.168.1.123:1400/xml/device_description.xml - Create expectation to track connections to this host:port (tcp) 3) Outbound connection to device's web server (there will be several of these) - Watch for a SUBSCRIBE request - Find the control point's callback URL, e.g. CALLBACK: <http://192.168.1.124:3500/notify> - Create expectation to open up inbound connections to this host:port 4) Inbound connections to control point's web server - The device will send NOTIFY HTTP requests to inform the control point of new events. These can continue indefinitely. Each NOTIFY request arrives on a new TCP connection and may have a different source port. Add the necessary code to create expectations for each of these connections and rewrite the IP in the CALLBACK URL. Tested with and without NAT. Signed-off-by: Kevin Cernekee <cernekee@chromium.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: Add new mdns helperKevin Cernekee2016-09-091-1/+11
| | | | | | | | | | This allows unicast replies to multicast DNS (mDNS / RFC6762) queries. These queries are often used when a full-featured mDNS service (such as avahi-daemon) is not running, or if an mDNS client does not have permission to bind to port 5353. Signed-off-by: Kevin Cernekee <cernekee@chromium.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc/manual: include some bits about init systemsArturo Borrero2016-09-051-0/+51
| | | | | | | | | | | | Update the conntrack-tools manual to include some bits regarding init systems and the integration with systemd. More on this topic here: http://ral-arturo.blogspot.com.es/2016/08/why-conntrackd-in-debian-is-better-with.html Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: Disable runtime systemd support by defaultPablo Neira Ayuso2016-02-174-8/+8
| | | | | | | | | | | | By default, conntrackd is compiled with no built-in systemd support. This patch updates the default runtime behaviour to be consistent with what ./configure provides by default. Thus, users should explicitly indicate "Systemd On" in their configuration file to enable this. This shouldn't cause any problem to old users of conntrackd. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add systemd supportArturo Borrero2015-11-174-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds basic systemd support. The feature can be enabled/disabled at configure time: ./configure --disable-systemd Also, at runtime in conntrackd.conf General { Systemd on|off } (by default it's enabled both at runtime and at configure time) * tell systemd about conntrackd readiness: When conntrackd starts, it will send systemd the data "READY=1". At the point the data is sent, conntrackd is fully ready to work (configuration was OK, sockets OK, et all), so other actions depending on conntrackd can be safely chained in the machine boot process. * tell systemd about conntrackd shutting down: If the admin kills conntrackd with `conntrackd -k', the data "STOPPING=1" will be send to systemd so it learns about the daemon shutting down. Same for manual signals. * watchdog support: The admin can configure systemd to watch the conntrackd daemon and perform some actions if conntrackd dies: restart it, reboot the machine, etc... Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: update syntax in documentationPablo Neira Ayuso2015-09-082-3/+3
| | | | | | | Since dd73ceecdbe8 ("nfct: Update syntax to specify command before subsystem") the command comes before the object type. Update documentation accordingly. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc/debian.conntrackd.init.d: drop fileArturo Borrero Gonzalez2015-08-261-48/+0
| | | | | | | | | | This file is likely dead code. It's outdated. Also I think distributors should manage themselves to integrate daemons in their operating systems. Following this idea, this file doesn't belong here. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: userspace SSDP helperAsh Hughes2014-03-122-0/+9
| | | | | | | | | | | | | Here is a patch which adds a userspace conntrack helper for the SSDP protocol. This is based on the code found at: http://marc.info/?t=132945775100001&r=1&w=2 I'm not sure how to get my laptop to play at IPv6, so I've not tested this part, but I've tested the IPv4 section and it works. Signed-off-by: Ash Hughes <ashley.hughes@blueyonder.co.uk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: helpers: add DHCPv6 helperPablo Neira Ayuso2013-09-261-0/+8
| | | | | | | | | | | | | | | This patch adds support for the DHCPv6 helper. 1) nfct helper add dhcpv6 inet6 udp 2) ip6tables -I OUTPUT -t raw -p udp --sport 546 -j CT --helper dhcpv6 3) run conntrackd You should see: % conntrack -L exp -f ipv6 279 proto=17 src=:: dst=ff02::1:2 sport=0 dport=546 mask-src=:: mask-dst=ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff sport=0 dport=65535 master-src=fe80::221:ccff:fe4a:7f9c master-dst=ff02::1:2 sport=546 dport=547 PERMANENT class=0 helper=dhcpv6 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: detail user-space helper supportPablo Neira Ayuso2012-10-081-5/+150
| | | | | | This patch adds documentation on how to enable user-space helper support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix crash if ExpectationSync is enabled on old Linux kernelsPablo Neira Ayuso2012-10-044-3/+13
| | | | | | | | | | ExpectationSync requires Linux kernel >= 3.5 to work sanely, document this. Still, we don't want to crash if someone enables expectation sync with old Linux kernels (like 2.6.32). Reported-by: James Gutholm <gutholmj@evergreen.edu> Tested-by: James Gutholm <gutholmj@evergreen.edu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: add QueueLen optionPablo Neira Ayuso2012-09-101-0/+13
| | | | | | | | | | | This patch adds the QueueLen option, that allows you to increase the maximum number of packets waiting in the nfnetlink_queue to receive a verdict from userspace. Rising the default value (1024) is useful to avoid hitting the following error message: "nf_queue: full at X entries, dropping packets(s)". Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: TNS helper added to cthelperJozsef Kadlecsik2012-08-011-0/+7
| | | | | Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: RPC helper added to cthelperJozsef Kadlecsik2012-08-011-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | How to use this helper in a few steps: 1) You can enable this helper via: nfct helper add rpc inet tcp nfct helper add rpc inet udp 2) Configure /etc/conntrackd/conntrackd.conf and launch it. 3) You can test this helper locally with the following rule-set: iptables -A OUTPUT -t raw -p udp -m udp --dport 111 -j CT --helper rpc iptables -A OUTPUT -t raw -p tcp -m tcp --dport 111 -j CT --helper rpc iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 111 -j ACCEPT iptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -m udp --dport 111 -j ACCEPT iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -P OUTPUT DROP 4) Configure NFS and export some local directory. Then, mount it with version 3. mount.nfs -onfsvers=3 127.0.0.1:/srv/cvs /mnt/ You should see permanent expectations created for this. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add cthelper infrastructure (+ example FTP helper)Pablo Neira Ayuso2012-08-011-0/+82
| | | | | | | | | | | | This patch adds the user-space helper infrastructure. It also contains the implementation of the FTP helper in user-space. There's one example file that you can use to configure conntrackd as user-space connection tracking helper under: doc/helper/conntrackd.conf Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix documentation on ExpectationSync and H.323 helperPablo Neira Ayuso2012-06-161-1/+3
| | | | | | | | | | | | | The H.323 helper is actually composed of three helpers: ras q.931 h.245 We have to specify those in the configuration file since h.323 is not any known helper itself. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix example on how to filter events via iptables CT targetPablo Neira Ayuso2012-03-051-2/+3
| | | | | | | | | | | | | | | | You have to use this: iptables -I PREROUTING -t raw -j CT --ctevents assured,destroy instead of: iptables -I PREROUTING -t raw -j CT --ctevents assured Otherwise, conntrackd cache gets full since no destroy events are delivered. Reported-by: Kerin Millar <kerframil@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add ras, q.931 and h.245 to examples configuration filePablo Neira Ayuso2012-02-213-3/+9
| | | | | | | | | | | | | | | Now it includes: ExpectationSync { ... ras q.931 h.245 } Which are the set of helpers for h.323. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update conntrack-tools manual to detail expectation supportPablo Neira Ayuso2012-01-101-2/+159
| | | | | | | This patch updates the user manual on how to enable the expectation support for conntrackd. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: support for expectation synchronizationPablo Neira Ayuso2012-01-103-0/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support to synchronize expectations between firewalls. This addition aims to re-use as much as possible of the existing infrastructure for stability reasons. The expectation support has been tested with the FTP helper. This extension requires libnetfilter_conntrack 1.0.0. If this is the first time you're playing with conntrackd, I *strongly* recommend you to get working setup of conntrackd without expectation support before as described in the documentation. Then, enabling expectation support is rather easy. To know more about expectations, if you're not familiar with them, I suggest you to read: "Netfilter's Connection Tracking System" http://people.netfilter.org/pablo/docs/login.pdf Reprinted from ;login: The Magazine of USENIX, vol. 31, no. 3 (Berkeley, CA: USENIX Association, 2006, pp40-45.) In short, expectations allow one Linux firewall to filter multi-flow traffic like FTP, SIP and H.323. In my testbed, there are two firewalls in a primary-backup configuration running keepalived. The use a couple of floating cluster IP address (192.168.0.100 and 192.168.1.100) that are used by the client. These firewalls protect one FTP server (192.168.1.2) that will be accessed by one client. In ASCII art, it looks like this: 192.168.0.100 192.168.1.100 eth1 eth2 fw-1 / \ FTP -- client ------ ------ server -- 192.168.0.2 \ / 192.168.1.2 fw-2 This is the rule-set for the firewalls: -A POSTROUTING -t nat -s 192.168.0.2/32 -d 192.168.1.2/32 -j SNAT --to-source 192.168.1.100 -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -m state --state INVALID -j DROP -A FORWARD -m state --state RELATED -j ACCEPT -A FORWARD -i eth2 -m state --state ESTABLISHED -j ACCEPT -A FORWARD -i eth1 -p tcp -m tcp --dport 21 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT -A FORWARD -i eth1 -p tcp -m state --state ESTABLISHED -j ACCEPT -A FORWARD -m state --state INVALID -j LOG --log-prefix "invalid: " The following steps detail how to check that the expectation support works fine for conntrackd: 1) You have to enable the expectation support in the configuration file with the following option: Sync { ... Options { ExpectationSync { ftp sip h323 } } } This enables expectation synchronization for the FTP, SIP and H.323 helpers. You can alternatively use: Sync { ... Options { ExpectationSync On } } To enable expectation synchronization for all helpers. 2) Make sure you have loaded the FTP helper in both firewalls. root@fw1# modprobe nf_conntrack_ftp root@fw2# modprobe nf_conntrack_ftp 3) Switch to the client. Start one FTP control connection to one server that is protected by the firewalls, enter passive mode: (term-1) user@client$ nc 192.168.1.2 21 220 dummy FTP server USER anonymous 331 Please specify the password. PASS nothing 230 Login successful. PASV 227 Entering Passive Mode (192,168,1,2,163,11). This means that port 163*256+11=41739 will be used for the data traffic. Read this if you are not familiar with the FTP protocol: http://www.freefire.org/articles/ftpexample.php 3) Switch to fw-1 (primary) to check that the expectation is in the internal cache. root@fw1# conntrackd -i exp proto=6 src=192.168.0.2 dst=192.168.1.2 sport=0 dport=41739 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.0.2 master-dst=192.168.1.2 sport=36390 dport=21 [active since 5s] 4) Switch to fw-2 (backup) to check that the expectation has been successfully replicated. root@fw2# conntrackd -e exp proto=6 src=192.168.0.2 dst=192.168.1.2 sport=0 dport=41739 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.0.2 master-dst=192.168.1.2 sport=36390 dport=21 [active since 8s] 5) Make the primary firewall fw-1 fail. Now fw-2 becomes primary. 6) Switch to fw-2 (primary) to commit the external cache into the kernel. root@fw2# conntrackd -c exp The logs should display that the commit was successful: root@fw2# tail -100f /var/log/conntrackd.log [Wed Dec 7 22:16:31 2011] (pid=19195) [notice] committing external cache: expectations [Wed Dec 7 22:16:31 2011] (pid=19195) [notice] Committed 1 new entries [Wed Dec 7 22:16:31 2011] (pid=19195) [notice] commit has taken 0.000366 seconds 7) Switch to the client. Open a new terminal and connect to the port that has been announced by the server: (term-2) user@client$ nc -vvv 192.168.1.2 41739 (UNKNOWN) [192.168.1.2] 41739 (?) open 8) Switch to term-1 and ask for the file listing: [...] 227 Entering Passive Mode (192,168,1,2,163,11). LIST 9) Switch to term-2, it should display the listing. That means everything has worked fine. You may want to try disabling the expectation support and repeating the steps to check that *it does not work* without the state-synchronization. You can also display expectation statistics by means of: root@fwX# conntrackd -s exp This update requires no changes in the primary-backup.sh script that is used by the HA manager to interact with conntrackd. Thus, we provide a backward compatible command line interface. Regarding the Filter clause and expectations, we use the master conntrack to filter expectation events. The filtering is performed in user-space. No kernel-space filtering support for expectations yet (this support should go in libnetfilter_conntrack at some point). This patch also includes support to disable caching and to allow direct injection of expectations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: primary-backup.sh: clarify licensing terms (GPLv2+)Pablo Neira Ayuso2011-12-301-4/+6
| | | | | | | This script is released under GPLv2+. Update copyright notice as well. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: prepare 1.0.0 release in conntrack-tools manualPablo Neira Ayuso2011-02-271-2/+1
| | | | | | | Remove reference which states that this is still under development and refer to version 1.0.0. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add missing conntrackd -s invocation with optionsPablo Neira Ayuso2011-02-221-1/+5
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add reference to the CT target againPablo Neira Ayuso2011-02-221-0/+27
| | | | | | | Now that we have fixed several aspects of the event filtering in 2.6.38, I reintroduce the documentation for this feature. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: document redundant link support for conntrackdPablo Neira Ayuso2011-02-181-0/+39
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: document -s option of conntrackd in the manualPablo Neira Ayuso2011-02-181-0/+115
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: remove reference to the CT targetPablo Neira Ayuso2011-02-011-23/+0
| | | | | | | Sorry, the iptables CT target is not yet ready for use until some patches are pushed to the Linux kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update conntrack-tools manualPablo Neira Ayuso2011-01-161-6/+112
| | | | | | | | | | | | | This update adds to the documentation the following information: * add reference to "Demystifying cluster-based fault-tolerant firewalls" * add how-to disable the external cache * add how-to disable the internal cache * add how-to set the synchronization transport protocol * document iptables CT target * ask for sponsors to finish H323 and SIP support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: minor documentation update (two new questions in the FAQ)Pablo Neira Ayuso2010-08-041-1/+27
| | | | | | | This patch includes a minor documentation update with two new questions in the FAQ. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix wrong kernel requirements for TCPWindowTracking in example filesPablo Neira Ayuso2010-08-043-3/+3
| | | | | | | | This patch fixes wrong Linux kernel requirements in the example configuration files. We require a Linux kernel >= 2.6.36 instead of >= 2.6.35 as the files suggest. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: warn on TCPWindowTracking option (it requires kernel >= 2.6.35)Pablo Neira Ayuso2010-07-153-0/+3
| | | | | | | This patch adds a comment on the TCPWindowTracking option to warn that this will be supported since the Linux kernel 2.6.35. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix ICMPv6 supportPablo Neira Ayuso2010-07-013-0/+3
| | | | | | | | | | | This patch fixes several minor nitpicks to support IPv6 failover: * ICMPv6 type/code/id were missing in synchronization messages. * The use of '-' as string in the configuration file was not allowed. * Include example in configuration file under doc/. Reported-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: description on how to block traffic with conntrack was incompletePablo Neira Ayuso2010-05-101-2/+7
| | | | | | | | | This patch completes the documentation with the following discussion that took place in the mailing list. http://marc.info/?l=netfilter&m=127335152521674&w=2 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: PollSecs goes in the General clause for statisticsPablo Neira Ayuso2010-02-281-12/+12
| | | | | | | | This patch fixes the configuration file that includes an example of the PollSecs clause in Stats. This is wrong since it should go in the General clause. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add support for TCP window scale factor synchronizationPablo Neira Ayuso2010-02-113-0/+32
| | | | | | | This patch adds a new option TCPWindowTracking that allows not to disable TCP window tracking as it occurs by default. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix UDP filtering in configuration filePablo Neira Ayuso2010-02-114-0/+4
| | | | | | | | UDP filtering was broken during the addition of the UDP-based synchronization protocol that was introduced in 0.9.14. This patch fixes the problem. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: document internal cache disabling and TCP-based synchronizationPablo Neira Ayuso2009-12-232-4/+61
| | | | | | | | This patch documents the internal cache disabling feature that is available for the NOTRACK mode. I have also added an example on how to set up a TCP-based state-synchronization. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-01 07:34:11 +0000