summaryrefslogtreecommitdiffstats
path: root/include/network.h
Commit message (Collapse)AuthorAgeFilesLines
* sync-mode: rename mcast_track_*() by nethdr_track_*()Pablo Neira Ayuso2009-03-121-3/+3
| | | | | | | | This patch is a cleanup. It renames the mcast_track_*() functions by nethdr_track_*() because this functions are related to message sequence tracking. They are not stick to multicast at all. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-mode: add abstract layer to make daemon independent of multicastPablo Neira Ayuso2009-03-121-5/+0
| | | | | | | | | This patch reworks conntrackd to make it independent of the protocol used to propagate state-changes. This patch adds the channel layer abstraction, this layer allows you to add support for different protocols like unicast UDP or TIPC. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: fix endianess issue in acknowledgment network headerPablo Neira Ayuso2009-02-201-0/+7
| | | | | | | | This patch fixes an endianess issue in the acknowledgment network header. This breaks backward compatibility if different conntrackd versions are used. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: fix endianess issue in synchronization network headerPablo Neira Ayuso2009-02-201-0/+7
| | | | | | | | This patch fixes an endianess issue in the synchronization network header. This breaks backward compatibility if different conntrackd versions are used. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for approximate timeout calculation during commitPablo Neira Ayuso2009-01-251-1/+1
| | | | | | | | | | During the commit phase, the entries in the external cache entries are inserted in the kernel conntrack table. Currently, we use a fixed timeout that is specified in the config file. With this patch, if you don't specify the fixed timeout value via CommitTimeout, the daemon calculates the real timeout value during the commit phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for redundant dedicated linksPablo Neira Ayuso2009-01-171-3/+3
| | | | | | | | This patch adds support for redundant dedicated links. You can add a pool of dedicated links that can be used if the current active fails. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add status field to store the object statusPablo Neira Ayuso2009-01-151-0/+1
| | | | | | | | | This patch adds the status field to the cache object. This avoids the (ab)use of the alarm to check if an entry is active or dead. This is the first step to possibly move the alarm to the cache_extra memory space of the ftfw (which is the only use by now). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rework of the hash-cache infrastructurePablo Neira Ayuso2009-01-151-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | Currently, the caching system is implemented in a two layer architecture: hashtable (inner layer) and cache (upper layer). This patch reworks the hash-cache infrastructure to solve some initial design problems to make it more flexible, the main strong points of this patch are: * Memory handling is done in the cache layer, not in the inner hashtable layer. This removes one of the main dependencies between the hashtable and the cache classes. * Remove excessive encapsulation: the former cache used to hide a lot of details of the inner hashtable implementation. * Fix over-hashing of some operations: lookup-delete-add required three hash calculations. Similarly, the update-or-add operation required two hash calculations. Now, we calculate the hash once and re-use the value how many times as we need. This patch simplifies the caching system. As a result, we save ~130 lines of code. Small code means and less complexity means less chance to have bugs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ftfw: shrink alive message sizePablo Neira Ayuso2008-12-131-3/+3
| | | | | | | | | | This patch reduces the size of alive messages by removing the "from" and "to" fields which are not of any help. This patch also removes the IS_CTL() macro since it does not return true for the control messages anymore but only for IS_ACK(), IS_NACK() and IS_RESYNC(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: do more strict message type checkingPablo Neira Ayuso2008-12-131-5/+7
| | | | | | | This patch adds more strict checking in the message type. We add a new message type NET_T_CTL for control messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: use NET_T_* instead of NFCT_Q_*Pablo Neira Ayuso2008-12-131-0/+7
| | | | | | | | This patch replaces the use of NFCT_Q_* in the message type by specific network message type NET_T_*. The query types are reserved for libnetfilter_conntrack operations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parse: strict attribute size checkingPablo Neira Ayuso2008-12-081-0/+2
| | | | | | | This patch adds strict attribute size checking. This is good to detect corrupted or malformed messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: fix data offset alignment returned by NTA_DATA macroPablo Neira Ayuso2008-12-081-1/+1
| | | | | | | This patch aligns the data offset that is returned by the NTA_DATA macro. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: remove the netpld header from the messagesPablo Neira Ayuso2008-12-081-25/+22
| | | | | | | | | This patch simplifies the message format of the replication messages. As a result, we save four bytes. The netpld header was introduced in the early protocol design. Today, it does not have any reason to exist. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: remove length parameter of mcast_buffered_send_netmsg()Pablo Neira Ayuso2008-12-081-1/+1
| | | | | | | | This patch simplifies mcast_buffered_send_netmsg() by removing the length parameter. Instead, we use the length field in the nethdr to know the message size to be sent. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: remove unused function mcast_send_netmsg()Pablo Neira Ayuso2008-12-081-1/+0
| | | | | | This patch removes the unused function mcast_send_netmsg(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parse: fix missing master layer 4 protocol number assignationPablo Neira Ayuso2008-12-081-0/+1
| | | | | | | | | | | This patch fixes NTA_MASTER_L4PROTO parsing which was missing. This problem was introduced in "network: rework TLV-based protocol", commit id 76ac8ebe5e49385585c8e29fe530ed4baef390bf, ie. somewhere in the development of 0.9.9. This patch also fixes the size of parsing callback array that is NTA_MAX, not ATTR_MAX. This problem does not affect conntrack-tools <= 0.9.8. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: do not include NTA_TIMEOUT in the replication messagesPablo Neira Ayuso2008-12-061-1/+1
| | | | | | | | | With this patch, NTA_TIMEOUT is not included in the replication messages anymore. During the fail-over, we set a small timeout to purge the entries that were not recovered successfully (however, unsuccessful recovery should not happen ever). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: make tx buffer initialization independent of mcast configPablo Neira Ayuso2008-11-301-1/+1
| | | | | | | | | | This patch changes the prototype of mcast_buffered_init() to receive as argument the MTU size instead of the multicast configuration. This decouples the initialization of the tx buffer from the multicast configuration. This patch is needed by the multi-dedicated link support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add attribute header size to total attribute lengthPablo Neira Ayuso2008-11-251-3/+3
| | | | | | | | | | | | | | This patch adds the size of the attribute header (4 bytes) to the length field of netattr. This fixes a possible invalid memory access in malformed messages. This change is included in the set of scheduled changes for 0.9.9 that break backward compatibility. This patch also removes a memset of 4096 by one to initialize the headers and the netattr paddings. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: rework TLV-based protocolPablo Neira Ayuso2008-11-021-0/+29
| | | | | | | | | | | | | | | This patch reworks the TLV-based protocol to reduce the overhead in the message building. The idea is to group some attributes that must be present in a consistent configuration. Putting them together help us to save some cycles in the message building. Now, oprofile reports ~15% of samples in the build path instead of ~25%. CPU consumption for 3000 HTTP GET requests per second (1000 concurrent with apache benchmark tool) is ~45% in my testbed, that is ~19% more consumption than with no replication at all. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: add protocol version field (breaks backward compatibility)Pablo Neira Ayuso2008-11-021-4/+6
| | | | | | | | | | | | | This patch adds the version field (8-bits long) to the nethdr structure. This fields can be used to indicate the protocol version in case that we detect an incompatibility between two conntrackd daemons working with different protocol versions. Unfortunately, this patch breaks backward compatibility, ie. conntrackd <= 0.9.8 protocol is not compatible with the upcoming conntrackd >= 0.9.9. Better do this now than later. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ftfw: fix race condition in the helloing routinePablo Neira Ayuso2008-09-251-6/+0
| | | | | | | | | | | | | | | | | | | | This patch fixes a race condition that can prevent one node from sending the initial hello message required to reset the sequence tracking. node A node B | | start | | hello msg |----------------------->| stop | | start | | |<-----------------------| hello-back msg In the picture above, the node A never sends the hello messages. Thus, the node B drops the next messages as they are in the before boundary. This patch adds a new state to the the helloing state-machine to fix this problem. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rework the HELLO logic inside FT-FWPablo Neira Ayuso2008-05-261-1/+11
|
* improve network message sanity checkingsPablo Neira Ayuso2008-05-181-2/+1
|
* rework of the FT-FW approach/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-261-15/+23
|
* Pablo Neira Ayuso <pablo@netfilter.org>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-03-251-1/+1
| | | | | | | o remove .svn directory from make distcheck tarballs (reported by B.Benjamini) + Krzysztof Oledzki <ole@ans.pl>: o fix minor compilation warning
* Max Kellermann <max@duempel.org>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-231-3/+4
| | | | use size_t
* Max Kellermann <max@duempel.org>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-231-1/+0
| | | | remove unused prototype in network.h
* Max Kellermann <max@duempel.org>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-171-0/+2
| | | | import only required C headers and put local headers on top to check
* Max Kellermann <max@duempel.org>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-171-17/+17
| | | | use C99 integers (uint32_t instead of u_int32_t)
* Max Kellermann <max@duempel.org>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-151-1/+1
| | | | Fix tons of gcc warnings
* Max Kellermann <max@duempel.org>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-151-0/+6
| | | | add missing function prototypes
* Max Kellermann <max@duempel.org>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-151-4/+4
| | | | use the comma operator instead of curly braces
* conntrackd:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2007-07-181-0/+7
| | | | | | | | | - use buffer of MTU size conntrack: - better protocol argument checkings - fix per-protocol filtering, eg. conntrack -[L|E] -p tcp now works - show per-protocol help, ie. conntrack -h -p tcp - add alias --src for --orig-src and alias --dst for --orig-dst
* - conntrack-tools requires libnetfilter_conntrack >= 0.0.81 /C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2007-07-091-2/+104
| | | | | | | | | | | | | - add len field to nethdr - implement buffered send/recv to batch messages - stop using netlink format for network messages: use similar TLV-based format - reduce synchronization messages size up to 60% - introduce periodic alive messages for sync-nack protocol - timeslice alarm implementation: remove alarm pthread, remove locking - simplify debugging functions: use nfct_snprintf instead - remove major use of libnfnetlink functions: use libnetfilter_conntrack API - deprecate conntrackd -F, use conntrack -F instead - major rework of the network infrastructure: much simple, less messy
* - more cleanups and code refactorization/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2007-06-191-10/+12
| | | | | | - remove several debug calls - create a child to dispatch dump requests: this will help to simplify the current locking schema. Later.
* - local requests return EXIT_FAILURE if it can't connect to the daemon/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2007-06-131-2/+3
| | | | - several cleanups
* o remove useless backlog parameter in multicast sockets/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2007-06-041-0/+19
| | | | | | | | o remove reminiscents of delay destroy message and relax transitions o remove confusing StripNAT parameter: NAT support enabled by default o relax event tracking: *_update callbacks use cache_update_force o use wraparound-aware functions after/before/between o lots of cleanups
* simplify checksum code: use UDP/multicast checksum facilities/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2007-05-241-1/+0
|
* first step forward to merge conntrackd and conntrack into the same building ↵/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2007-04-161-0/+34
chain