summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* conntrackd: fix error handling in nfq_queue_cb()Pablo Neira Ayuso2015-08-182-15/+16
| | | | | | | Make sure we have a clean exit on error, everything needs to be properly released. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix descriptor leak in do_local_request()Pablo Neira Ayuso2015-08-181-2/+5
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix leak in fork_process_new()Pablo Neira Ayuso2015-08-181-0/+2
| | | | | | Release the child_process structure in case that fork() fails. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: NTA_MAX is also an invalid attributePablo Neira Ayuso2015-08-181-1/+1
| | | | | | Otherwise this can result in an off-by-one array access. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix sanitization of expection attribute in the wire formatPablo Neira Ayuso2015-08-181-1/+1
| | | | | | The maximum number of attribute is NTA_EXP_MAX for expectation sync messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: made the protocol option value case insensitiveSzilárd Pfeiffer2015-07-031-1/+1
| | | | | | | | | Extensions register protocols by lowercase protocol name, but value of proto command line option may be uppercase. Extension related options cannot be used when protocol name comparision fails. Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix expectation entry creationSzilárd Pfeiffer2015-06-261-0/+2
| | | | | Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: refactor handling of address optionsSzilárd Pfeiffer2015-06-261-37/+32
| | | | | Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cthelper: Optimise nfq_queue_cbPaul Aitken2015-06-121-5/+3
| | | | | | | | ct and myct have both already been checked for non-NULL, so there's no need to check either of them again later. Signed-off-by: Paul Aitken <paitken@brocade.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: remove unused 'numbytes'Paul Aitken2015-06-121-2/+1
| | | | | | | 'numbytes' isn't used and can be removed. Signed-off-by: Paul Aitken <paitken@brocade.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: Fix wrong memset usagePablo Neira Ayuso2015-05-291-17/+6
| | | | | | | | memset fills bytes, not ulongs - so the second parameter (the fill value) has to be a byte. Reported-by: Paul Aitken <paitken@brocade.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cthelper: don't pass up a 0 length queueChas Williams III2015-05-211-1/+4
| | | | | | | | | If the user didn't specify a queue length in the configuration file it will have a length of 0. Allow the kernel's default to take precedence instead. Signed-off-by: Charles (Chas) Williams <ciwillia@brocade.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Use <fcntl.h> instead of legacy synonym <sys/fcntl.h>Felix Janda2015-05-211-1/+1
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Define _GNU_SOURCE to get members of tcphdr&ucphdrFelix Janda2015-05-214-0/+4
| | | | | | | | | The source uses linux names for members of tcphdr. For example "source" instead of "th_sport", ... musl libc's headers need _GNU_SOURCE defined in order to expose these. Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Use stdint typesFelix Janda2015-05-216-9/+9
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: allow strings with underscore from flex scannerPablo Neira Ayuso2015-02-191-1/+1
| | | | | | | | | Some people use interface names with underscores, so allow them from the flex scanner. Original patch from http://patchwork.ozlabs.org/patch/440600/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix setting labels in updatesJarno Rajahalme2015-02-131-5/+19
| | | | | | | | | | | | | | | | | | When updating labels we always have to send the same sized bitmask as we received, as the bits we do omit will otherwise cleared as "padding". Mask has to have the same size as the labels, otherwise it will not be encoded by libnetfilter_conntrack, as different sizes are not accepted by the kernel either. Finally, kernel only retains old bit values that we send as zeroes in BOTH the label and the mask, due to XOR used in bit manipulation. This patch fixes all these issues and allows updates to set new labels without accidentally clearing old ones. Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* channel: Fix file descriptor leak in channel_open() on errorThomas Jarosch2014-12-111-0/+1
| | | | | | | Detected by cppcheck Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: build: fix crash when optional kernel modules are not loadedPablo Neira Ayuso2014-06-131-9/+13
| | | | | | | | | Fix a possible crash if conntrackd sees DCCP, SCTP and ICMPv6 traffic and the corresponding kernel modules that track this traffic are not available. Fixes: http://bugzilla.netfilter.org/show_bug.cgi?id=910 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* udp: bind UDP sender side to same interface of the receiver sidePablo Neira Ayuso2014-05-291-2/+6
| | | | | | | | | Otherwise, the kernel may select a different interface for the client side. Original patch from Michael Griego. While at it, remove some trailing whitespaces. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: timeout: add support for default protocol timeout tuningPablo Neira Ayuso2014-05-131-2/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new interface supersedes the /proc interface: /proc/sys/net/netfilter/nf_conntrack_PROTO_STATE_timeout to tune default conntrack timeout helpers. # nfct timeout default-get inet tcp .l3proto = 2, .l4proto = 6, .policy = { .SYN_SENT = 120, .SYN_RECV = 60, .ESTABLISHED = 432000, .FIN_WAIT = 120, .CLOSE_WAIT = 60, .LAST_ACK = 30, .TIME_WAIT = 120, .CLOSE = 10, .SYN_SENT2 = 120, .RETRANS = 300, .UNACKNOWLEDGED = 300, }, }; # nfct timeout default-set inet tcp ESTABLISHED 100 As replacement for the existing /proc interfaces for timeout tweaking. This feature requires a Linux kernel >= 3.13. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: remove unneeded included headerPablo Neira Ayuso2014-05-121-2/+0
| | | | | | | | This fixes a compilation breakage when libnetfilter_cttimeout.h is not installed. Reported-by: Hangbin Liu <liuhangbin@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: userspace SSDP helperAsh Hughes2014-03-122-1/+140
| | | | | | | | | | | | | Here is a patch which adds a userspace conntrack helper for the SSDP protocol. This is based on the code found at: http://marc.info/?t=132945775100001&r=1&w=2 I'm not sure how to get my laptop to play at IPv6, so I've not tested this part, but I've tested the IPv4 section and it works. Signed-off-by: Ash Hughes <ashley.hughes@blueyonder.co.uk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: Don't hardcode libs dir pathHani Benhabiles2013-10-151-2/+1
| | | | | | | Use CONNTRACKD_LIB_DIR instead of hardcoded path. Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: Fix use-after-free / double-freeHani Benhabiles2013-10-111-4/+0
| | | | | | | | | | | | helper's list and flush commands handlers shouldn't call mnl_socket_close on the passed netlink socket as it is done in the main function after parse_params call. Bug introduced in (3c78a45 nfct: src: consolidate netlink socket creation). Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: add amanda helperPablo Neira Ayuso2013-10-072-1/+209
| | | | | | | This patch adds a userspace port of the amanda helper that is currently implemented in the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
* conntrackd: cthelper: add TFTP helperPablo Neira Ayuso2013-10-033-0/+167
| | | | | | | | This patch adds an userspace port of the TFTP helper that is currently implemented in the kernel. This includes NAT support. It requires a Linux kernel 3.12. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: add SANE helperPablo Neira Ayuso2013-10-032-1/+178
| | | | | This patch adds an userspace port of the SANE helper that is currently implemented in the kernel. This requires Linux kernel 3.12 to work.
* nfct: src: consolidate netlink socket creationPablo Neira Ayuso2013-10-013-187/+66
| | | | | | | Open the socket from the main function, then pass it as parameter to the corresponding interpreter. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: src: add nfct_mnl_talk and use itPablo Neira Ayuso2013-10-013-158/+48
| | | | | | Add helper function nfct_mnl_talk and use it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: timeout: split nfct_cmd_timeout_add in several functionsPablo Neira Ayuso2013-09-301-43/+80
| | | | | | This patch is a cleanup to split this function in smaller chunks. It is required to prepare default protocol timeout tuning via netlink.
* nfct: timeout: use getprotoentPablo Neira Ayuso2013-09-301-22/+18
| | | | | | | The kernel bails out for unsupported protocols. Moreover, we don't need to upgrade to support new protocols. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add --disable-cthelper and --disable-cttimeoutPablo Neira Ayuso2013-09-263-12/+42
| | | | | | | | | | This patch allows you to disable userspace helper support and conntrack timeout tuning at build stage. By default, both features are enabled, to avoid breaking backward compatibility. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: modularize extensionsPablo Neira Ayuso2013-09-263-16/+70
| | | | | | Modularize timeout and helper extensions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: helpers: add DHCPv6 helperPablo Neira Ayuso2013-09-262-1/+129
| | | | | | | | | | | | | | | This patch adds support for the DHCPv6 helper. 1) nfct helper add dhcpv6 inet6 udp 2) ip6tables -I OUTPUT -t raw -p udp --sport 546 -j CT --helper dhcpv6 3) run conntrackd You should see: % conntrack -L exp -f ipv6 279 proto=17 src=:: dst=ff02::1:2 sport=0 dport=546 mask-src=:: mask-dst=ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff sport=0 dport=65535 master-src=fe80::221:ccff:fe4a:7f9c master-dst=ff02::1:2 sport=546 dport=547 PERMANENT class=0 helper=dhcpv6 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: allow to attach expectations via nfqueuePablo Neira Ayuso2013-09-261-0/+11
| | | | | | This requires the Linux kernel 3.12. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: do not exit when update returns an errorFlorian Westphal2013-09-151-5/+3
| | | | | | | | | | If we fail to update an entry, just try to continue with the next one instead of exiting. Can happen f.e. when using "conntrack -U --add-label bla", but the conntrack entry in the kernel does not have the label extension set. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: support add/delete of conntrack labelsClemence Faure2013-09-151-24/+130
| | | | | | | | new options "--label-add" and "--label-delete" to alter connlabels assigned to a connection. Signed-off-by: Clemence Faure <clemence.faure@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: support multiple -l optionsFlorian Westphal2013-09-151-1/+28
| | | | | | | | Using -l foo -l bar caused the "foo" label to be lost. Merge multiple -l options so "-l foo,bar" and "-l foo -l bar" have same effect. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: minor cleanupFlorian Westphal2013-09-041-22/+19
| | | | | | | | | Rename get_table to generic "optional argument handling" helper, so it can be re-used in upcoming patch. While at it, avoid copy&paste of "labelmap" handling. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix dump of IPv6 entries in the dying and unconfirmed listPablo Neira Ayuso2013-08-071-11/+12
| | | | | | Use selected the family, instead of inconditionally request for IPv4. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cthelper: fix IPv6 address and mask in newly created expectationsPablo Neira Ayuso2013-08-061-2/+2
| | | | | | Set to zero the entire address if needed, not just 4 bytes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix reporting of unknown argumentsClemence Faure2013-07-241-9/+7
| | | | | | | | | | | | | | | short options were always reported as "unknown argument". getopt(3) says: if [it] finds an option character in argv that was not included in optstring, or if it detects a missing option argument, it returns '?' and sets the external variable optopt to the actual option character. If the first character [...] of optstring is a colon (':'), then getopt() returns ':' instead of '?' to indicate a missing option argument. Signed-off-by: Clemence Faure <clemence.faure@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix -L format outputFlorian Westphal2013-07-241-1/+1
| | | | | | | | | commit d343b8c (conntrack: add connlabel format attribute) erronously removed _UNKNOWN format, i.e. conntrack -L displayed [UPDATE] tcp 6 114 TIME_WAIT src=.. ^^^^^ Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrackd: support replication of connlabelsFlorian Westphal2013-07-232-10/+106
| | | | | | | | | | | | | | | - check if ct has label attribute, and at least one label (bit) is set - serialize bitmap into array-of-u32, in network byte order - add code to build new nfct_bitmask object from array-of-u32 Current parse functions don't have length information, this adds optional parse2() which gets struct netattr pointer. Attributes that want to use parse2 need to set .maxsize to nonzero value. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: introduce -l option to filter by labelsClemence Faure2013-07-231-25/+131
| | | | | Signed-off-by: Clemence Faure <clemence.faure@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrackd: simplify expectation filteringPablo Neira Ayuso2013-07-115-30/+80
| | | | | | | | | | | | | | | | | | This patch simplifies the expectation filtering by looking up for the master conntrack. If it does not exists, then we assume that we don't want this expectation either. This simplification also fixes the current broken expectation filtering, since the master conntrack from expectations has neither reply tuple nor state, however, the filtering code assumes the opposite. This partially reverts (479a37a conntrackd: fix crash with IPv6 expectation in the filtering code) since it was incorrectly setting the reply tuple of the master conntrack. Thanks to Bill Fink for providing feedback to resolve this issue. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix crash with IPv6 expectation in the filtering codePablo Neira Ayuso2013-07-062-10/+29
| | | | | | | | | | | | | | | | | | | | | | | Jul 5 00:41:06 sen-fw1 kernel: [274422.060695] conntrackd[4821]: segfault at 0 ip 000000000040c660 sp 00007fffebb098a8 error 4 in conntrackd[400000+3d000] > #0 0x000000000040f217 in jhash2 (k=0x0, length=4, initval=0) at ../include/jhash.h:99 > a = 2654435769 b = 2654435769 c = 0 len = 4 > #1 0x000000000040f564 in ct_filter_hash6 (data=0x0, table=0x16ef630) at filter.c:57 > #2 0x000000000040ad34 in hashtable_hash (table=0x16ef630, data=0x0) at hash.c:63 > #3 0x000000000040fd19 in __ct_filter_test_ipv6 (f=0x16eeba0, ct=0x1703760) at filter.c:265 > id_src = 51 id_dst = 24051376 src = 0x1703760 dst = 0x0 The master conntrack of the expectation has no reply tuple. However, the filtering routine needs it. To avoid this issue, emulate the source address in the reply tuple. While at it, fix incorrect sanity checking that should have caught this issue. Thanks to Florian Westphal for initial diagnosing of this bug. Reported-by: Bill Fink <billfink@mindspring.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: deprecate `Family' in configuration filePablo Neira Ayuso2013-07-062-14/+7
| | | | | | | | | | | | | | | | | | | | | | This patch deprecates the `Family' tweak in the configuration file. Several reasons for this: * If not specified, this was default to IPv4 only in table dumps from the kernel. However, non-IPv4 events were still received. This is inconsistent. * It's an early tweak that was not documented (not included in any of the example files). If we want to support any sort of consistent filtering based on the family, this should happen in the filtering code. After this patch, conntrackd uses AF_UNSPEC to dump the conntrack and expectation tables from the kernel. Reported-by: Bill Fink <billfink@mindspring.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cache: fix hashing based on IPv6 addressPablo Neira Ayuso2013-07-062-2/+2
| | | | | | | Use source and destination address, not only source address for hashing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>