summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* snprintf: fix missing port output in DCCPPablo Neira Ayuso2009-04-242-0/+2
| | | | | | | | | | This patch adds missing DCCP ports in the output: # conntrack -D -p dccp dccp 33 18 RESPOND src=1.1.1.1 dst=2.2.2.2 packets=0 bytes=0 [UNREPLIED] src=2.2.2.2 dst=1.1.1.1 packets=0 bytes=0 mark=0 secmark=0 use=2 conntrack v0.9.12 (conntrack-tools): 1 flow entries have been deleted. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parse: fix SCTP vtag parsingPablo Neira Ayuso2009-04-181-2/+2
| | | | | | This patch fixes an unfortunate bug in the SCTP vtag parsing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* snprintf: fix output of GRE dstkey in XMLPablo Neira Ayuso2009-04-181-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* snprintf: fix missing protocol state support in XML outputPablo Neira Ayuso2009-04-141-5/+27
| | | | | | | This patch adds the missing bits to display the protocol state in the XML output. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* snprintf: remove duplicated protocol string definitionsPablo Neira Ayuso2009-04-145-72/+67
| | | | | | | | This patch merges duplicated protocol string definitions in the snprintf infrastructure. I have also fixed the size of the string array. This patch is a cleanup. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add initial DCCP supportPablo Neira Ayuso2009-04-1411-11/+138
| | | | | | This patch adds initial DCCP support for libnetfilter_conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* header: refresh nfnetlink_conntrack.h copyPablo Neira Ayuso2009-04-101-6/+6
| | | | | | This patch refreshes the nfnetlink_conntrack.h copy against 2.6.29. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove debian/ directoryPablo Neira Ayuso2009-03-067-60/+0
| | | | | | | This patch removes the debian directory. According to the debian policy, this directory should not be in source tree. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: deprecate several header files with obsolete enumsPablo Neira Ayuso2009-03-066-163/+20
| | | | | | | This patch deprecates several header files that contain enums that were define in the very old libnetfilter_conntrack API. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for UDPlite transport protocolPablo Neira Ayuso2009-03-053-2/+5
| | | | | | This patch adds support for UDPlite transport protocol. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for GRE transport protocolPablo Neira Ayuso2009-03-053-3/+21
| | | | | | | This patch adds support for GRE transport protocol. Tested-by: Byan Buff <bduff@ecessa.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove reminiscent of NFCT_DIR_ORIGINAL and old prototypesPablo Neira Ayuso2009-02-173-289/+4
| | | | | | | | This patch removes a reminiscent constant of the old API whose value is the same of __DIR_ORIG. This patch also removes the prototype definition from libnetfilter_conntrack.h. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: reset age interface since old API has been removedPablo Neira Ayuso2009-02-171-1/+1
| | | | | | This patch resets the library age since the old API has been removed Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove old deprecated APIPablo Neira Ayuso2009-02-1717-1903/+5
| | | | | | | | | This patch removes the first API version which was scheduled in 2007. That API had several major limitations that the new one solved. I don't know of any known existing client of this old API. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: do not inconditionally include TCP state into netlink messagelibnetfilter_conntrack-0.0.99Pablo Neira Ayuso2008-12-111-2/+5
| | | | | | | | This patch remove the inconditional inclusion of the TCP state attribute in netlink messages. We cannot assume this for update messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* headers: add CTA_NAT_SEQ_UNSPEC to linux_nfnetlink_conntrack.hPablo Neira Ayuso2008-12-101-0/+1
| | | | | | | This patch fixes an inconsistency in enum cta_natseq. The CTA_NAT_SEQ_UNSPEC was missing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: fix wrong use of errno in example filesPablo Neira Ayuso2008-12-1017-62/+116
| | | | | | | | | | | | This patch removes the use of strerr(errno) when the returned valued is != -1. This fixes random segfaults in my x86_64 machines. According to the documentation, errno should not be used unless the returned value is -1. This patch also includes some missing nfct_close() calls in the examples. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* api: fix minor issues in the kerneldoc style documentationPablo Neira Ayuso2008-12-091-25/+24
| | | | | | | This patch fixes some minor issues that confuse kernel-doc in the generation of the API reference documentation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* version: bump to 0.0.99Pablo Neira Ayuso2008-11-291-1/+1
| | | | | | Bump libnetfilter_conntrack version to 0.0.99 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* automake: add missing stack.h to include/internal/Makefile.amPablo Neira Ayuso2008-11-291-1/+1
| | | | | | | This patch fixes a missing stack.h file in Makefile.am. Maintaining a Makefile.am for the header files sucks a lot. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* api: fix bogus netlink flags in nfexp_build_querylibnetfilter_conntrack-0.0.98Pablo Neira Ayuso2008-11-291-2/+2
| | | | | | | This patch removes unnecessary flags included in NFCT_Q_DUMP, and NFCT_Q_DESTROY requests for expectations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* api: fix bogus netlink flags in nfct_build_queryPablo Neira Ayuso2008-11-291-3/+3
| | | | | | | This patch removes unnecessary flags included in NFCT_Q_DUMP, NFCT_Q_DUMP_RESET and NFCT_Q_DESTROY requests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* bsf: remove unnecessary function inlinePablo Neira Ayuso2008-11-281-9/+9
| | | | | | | | | This patch removes unnecessary function inlining in the BSF code generation. There is not reason to get any significant performance improvement in an operation that should be done in the initialization path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* bsf: major rework of the BSF generation codePablo Neira Ayuso2008-11-259-268/+420
| | | | | | | | | | | | | | | | This patch reworks the BSF automatic generation code. This feature needs more love and it has several limitations like that the maximum number of IPs are 127 due to BSF code restrictions. See this patch as a first step forward. This patch also adds the stack data type, which is used to resolve jump dynamically instead of the previous static approach. This patch also includes fixes in the limitations, previous calculations were wrong. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* helper: fix missing copy function for helper namePablo Neira Ayuso2008-11-232-0/+13
| | | | | | | | | | | | This patch fixes a NULL dereference to a function pointer in nfct_copy() that is triggered when you try to copy the helper name. This patch also adds an assertion to easily report similar problems in the future. Thanks to <pageexec@freemail.hu> for his detailed debugging report. Reported-by: Wolfram Schlich <lists@wolfram.schlich.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* qa: add test file to check for missing indirect function callsPablo Neira Ayuso2008-11-234-2/+111
| | | | | | | | This patch adds a rudimentary test file to check for possible unset indirect function calls. This automated test should be run after adding a new attribute. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set specific array size for the APIPablo Neira Ayuso2008-11-237-8/+8
| | | | | | | This patch adds the size of the arrays to set to NULL unset elements. This helps to spot unset functions for new attributes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* version: bump to 0.0.98Pablo Neira Ayuso2008-10-301-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* API: add nfct_attr_is_set_array functionPablo Neira Ayuso2008-10-302-0/+32
| | | | | | | This new function checks for the presence of a given set of attributes that are passed as an array. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* groups: add attribute group APIPablo Neira Ayuso2008-10-3012-3/+582
| | | | | | | | | | | | This new API allows you to set and get some logical set of attributes. This is not intended to replace the existing per-attribute get/set API but to provide more efficient way to get/set certain attributes. This change includes an example file (conntrack_grp_create.c) of the use of the attribute group API. See ATTR_GRP_* for more information on the existing groups. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* snprintf: fix compilation warning in 64-bits platformsPablo Neira Ayuso2008-10-301-2/+2
| | | | | | | We have to cast the counters to unsigned long long to fix a compilation warning in 64-bits platforms. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* API: use of __builtin_expect in error checking pathsPablo Neira Ayuso2008-10-303-10/+13
| | | | | | | | | This patch introduces likely() and unlikely() that use __builtin_expect to assist the compiler in the branch decisions. I am assuming that we have no clients of libnetfilter_conntrack that use gcc < 2.96. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* objopt: use indirect calls instead of switchPablo Neira Ayuso2008-10-302-63/+101
| | | | | | This patch replaces the use of switch by indirect function calls. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* helper: explicit helper assignation supportlibnetfilter_conntrack-0.0.97Pablo Neira Ayuso2008-10-137-0/+55
| | | | | | | | This patch adds support for explicit helper assignation. This support will not be of any help without the appropriate kernel support that will go into the Linux kernel 2.6.29 -sic-. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* compare: add two new flags for different level of comparisonsPablo Neira Ayuso2008-10-023-194/+346
| | | | | | | | This patch adds NFCT_CMP_MASK and NFCT_CMP_STRICT which determines the level of strictness that is applied to the comparison of two conntrack objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* API: fix endianess issueAlbert Veli2008-07-292-3/+3
| | | | | | | | In nfct_build_query() the *data argument is converted into a u_int8_t*. This works for little-endian but not for big-endian. Signed-off-by: Albert Veli <albert.veli@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cleanup: split internal.h into several internal header filesPablo Neira Ayuso2008-07-2545-449/+510
| | | | | | | This patch cleanups the internal headers by splitting them into several logical pieces. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* bsf: use ntohl instead of htonl in the examplePablo Neira Ayuso2008-07-231-1/+2
| | | | | | Fix wrong use of htonl in the example filter. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Extend high-level API for netlink BSF to add negative logicPablo Neira Ayuso2008-07-185-19/+124
| | | | | | | This patch introduces nfct_filter_set_logic() to set the filtering logic which results in a more flexible solution. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add berkeley socket filtering high-level APIPablo Neira Ayuso2008-07-179-3/+738
| | | | | | | | This patch adds an abstraction level to berkeley sockets filter (BSF) for Netlink sockets available since Linux kernel 2.6.26. This provides an easy way to attach filters without knowing about BSF at all. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add comment in expect_create test filePablo Neira Ayuso2008-07-151-0/+5
| | | | | | | | The test file requires nf_conntrack_ftp to work properly, otherwise it returns EINVAL. This patch adds a small comment to remember users to load the module before going ahead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* bump version to 0.0.96libnetfilter_conntrack-0.0.96Pablo Neira Ayuso2008-07-091-1/+1
|
* conditional compilation of testsuite utilsPablo Neira Ayuso2008-07-021-1/+1
| | | | | | Use `make check' to compile the examples in utils/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* remove slip through change in conntrack_event.cPablo Neira Ayuso2008-07-021-249/+1
|
* bump version to 0.0.95libnetfilter_conntrack-0.0.95Pablo Neira Ayuso2008-06-272-3/+251
|
* Use union of char buffer and message header to ensure proper byteFabian Hugelshofer2008-06-182-12/+18
| | | | | | alignment. Signed-off-by: Fabian Hugelshofer <hugelshofer2006@gmx.ch>
* fix wrong ATTR_*_L3PROTO handling in the message buildingPablo Neira Ayuso2008-06-161-8/+14
| | | | | | - include missing ATTR_MASTER_L3PROTO attribute into messages - include ATTR_[ORIG|REPL]_L3PROTO iff there is at least another layer 3 attribute
* fix bug in nfct_cmp() with IPv6 addresslibnetfilter_conntrack-0.0.94Pablo Neira Ayuso2008-05-271-4/+4
|
* define ICMPV6_NI_QUERY and ICMPV6_NI_REPLY if not setPablo Neira Ayuso2008-05-271-0/+8
|
* add full support of SCTPPablo Neira Ayuso2008-05-2110-3/+162
|