summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* snprintf: print conntrack helper name, tooFlorian Westphal2012-05-202-0/+27
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* Update .gitignoreJan Engelhardt2012-05-192-0/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: remove unused -DLIBNETFILTER_CONNTRACK_DIRJan Engelhardt2012-05-191-5/+0
| | | | | | | | CFLAGS must not be overriden if not set (it belongs to the user). Since -DLIBNETFILTER_CONNTRACK_DIR is unused however, remove it altogether. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* qa: change an if to elseifJan Engelhardt2012-05-191-1/+1
| | | | | | | The compiler is probably smart enough to see that the type cannot change, but make an "else" out of it, just for fun. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: remove unused LDFLAGSJan Engelhardt2012-05-192-24/+0
| | | | | | | "-ldl" is not needed since the programs themselves never use functions from libdl. Also, -dynamic is not required at all. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: bump version to 1.0.1libnetfilter_conntrack-1.0.1Pablo Neira Ayuso2012-05-182-2/+2
| | | | | | Also bump LIBVERSION. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: support NFCT_Q_CREATE_UPDATE in nfexp_queryKelvie Wong2012-05-071-0/+3
| | | | | | | | | This will work as it does in conntrack; it won't pass NLM_F_ACK into ctnetlink_new_expect in the kernel, and will thus invoke ctnetlink_change_expect if the expectation already exists. Signed-off-by: Kelvie Wong <kelvie@ieee.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* qa: add test case for get/set ATTR_GRP_* APIPablo Neira Ayuso2012-04-301-1/+66
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix new ATTR_GRP_[ORIG|REPL]_ADDR_[SRC|DST]Pablo Neira Ayuso2012-04-296-81/+125
| | | | | | | | | | The previous patch was incomplete. This fixes several issues with it like the IPV4 and IPV6 address are mutually exclusive, thus, the getter operation works. No sane way to support the setter operation correctly, thus, it's been documented that it has no effect. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add new ATTR_GRP_[ORIG|REPL]_ADDR_[SRC|DST] attributePablo Neira Ayuso2012-04-274-1/+87
| | | | | | | | | | | | | | | | | | | | This allows you to set and to get the address for both IPv4 and IPV6 using the same interface. This can simplify much redundant code that needs to support both protocols. This relies on some fixed layout union: union nfct_attr_grp_addr { u_int32_t ip; u_int32_t ip6[4]; u_int32_t addr[4]; }; But I don't see this library will support anything different from IPv4 and IPv6 as layer 3 protocol. If that happens and some point, we can add some new attribute group and deprecate this one. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix wrong building of ICMP reply tuplePablo Neira Ayuso2012-03-231-4/+1
| | | | | | | | | | | | For ICMP flows: conntrack -U -s 192.168.1.114 -m 1 returned -EINVAL. It seems we were including the reply tuple imcompletely. Reported-by: <abirvalg@lavabit.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* qa: several improvements for the ct_stress toolsPablo Neira Ayuso2012-03-122-9/+21
| | | | | | | | This patch improves several aspects of the QA tools to stress the conntrack system via ctnetlink and to check reliable event delivery. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* qa: add some stress tools to test conntrack via ctnetlinkPablo Neira Ayuso2012-03-063-1/+143
| | | | | | | | | | | | | | | | | | | | | ct_stress adds plenty of flows in assured state (worst case for the conntrack table). ct_events_reliable forces reliable event delivery. You have to use this tools together: ./ct_events_reliable & then: ./ct_stress 65535 # your ct table size If things go well, you will end up hitting ENOMEM. Both as root, of course. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for CTA_MARK_MASK and filtered dumpingPablo Neira Ayuso2012-02-0911-3/+238
| | | | | | | | This patch adds the infrastructure to allow filtered dumping. See utils/conntrack_dump_filter.c for instance. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: fix missing whitespace after expectation flags in nfexp_snprintfPablo Neira Ayuso2012-02-071-1/+5
| | | | | | | | | | | | | | Before: proto=17 src=192.168.11.4 dst=192.168.10.4 sport=0 dport=5060 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.10.4 master-dst=192.168.11.4 sport=5060 dport=5060 PERMANENTclass=0 helper=sip [active since 8s] After: proto=17 src=192.168.11.4 dst=192.168.10.4 sport=0 dport=5060 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.10.4 master-dst=192.168.11.4 sport=5060 dport=5060 PERMANENT class=0 helper=sip [active since 8s] Note the space after PERMANENT. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: fix comparison of expectation class and flagsPablo Neira Ayuso2012-02-071-4/+4
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: CTA_EXPECT_HELP_NAME must be NULL-terminatedPablo Neira Ayuso2012-02-061-1/+1
| | | | | | | Make sure this attribute is a NULL-terminated string, otherwise we hit EINVAL if we set this attribute. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add expectfn supportPablo Neira Ayuso2012-02-067-0/+32
| | | | | | This patch allows you to set expectfn. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add NAT supportPablo Neira Ayuso2012-02-067-0/+68
| | | | | | This patch adds ATTR_EXP_NAT_TUPLE and ATTR_EXP_NAT_DIR attributes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add class supportPablo Neira Ayuso2012-02-0610-0/+56
| | | | | | This patch allows you to specify the expectation class. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add XML support for nfexp_snprintf()Pablo Neira Ayuso2012-01-226-40/+303
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Example of the XML output: <flow type="new"> <layer3 protonum="2" protoname="IPv4"> <expected> <src>192.168.0.2</src> <dst>192.168.1.2</dst> </expected> <mask> <src>255.255.255.255</src> <dst>255.255.255.255</dst> </mask> <master> <src>192.168.0.2</src> <dst>192.168.1.2</dst> </master> </layer3> <layer4 protonum="6" protoname="tcp"> <expected> <sport>0</sport> <dport>41739</dport> </expected> <mask> <sport>0</sport> <dport>65535</dport> </mask> <master> <sport>36390</sport> <dport>21</dport> </master> </layer4> <meta> <helper-name>ftp</helper-name> <timeout>300</timeout> <zone>0</zone> </meta> </flow> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: bump version to 1.0.0libnetfilter_conntrack-1.0.0Pablo Neira Ayuso2012-01-042-2/+2
| | | | | | This patch bumps version to 1.0.0 and it bumps the API revision number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add nfexp_cmpPablo Neira Ayuso2012-01-047-6/+126
| | | | | | | | | This patch adds nfexp_cmp that allows you to compare two expectation objects. This includes the extension of test_api for this new function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: extend test_api for the expectation APIPablo Neira Ayuso2012-01-041-0/+52
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix set operation for master IPv6 src and dstPablo Neira Ayuso2012-01-041-2/+2
| | | | | | | | They seem to be accidentally swapped. Fix this. Spotted by qa/test_api. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* qa: extend test_api to validate set API for conntrack objectsPablo Neira Ayuso2012-01-041-0/+32
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: put nf_expect and nf_conntrack into dietPablo Neira Ayuso2012-01-0417-537/+524
| | | | | | | | | | | | | | | | Now, struct nf_expect takes only 192 bytes, instead of 1KB. struct nf_conntrack takes 296 bytes instead of 328 bytes. The size of the nf_expect structure has been reduced by rearranging the layout of the nf_conntrack structure. For the nf_conntrack case, this removes the allocation of room for attributes that the master tuple does not use (more specifically, the NATseq bytes). This patch modifies the binary layout of struct nf_conntrack. This should not be a problem since the definition of this object is opaque (it can be only accessed via get/set API). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: remove reference to licensing terms from headersPablo Neira Ayuso2012-01-026-42/+0
| | | | | | | | | | This patch removes the reference to the licensing terms of the library in the header files. This patch does *not* change the license of the library at all, which is still GPLv2+, of course. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix size of CTA_PROTOINFO_TCP_FLAGS_ORIGINAL in ARMPablo Neira Ayuso2011-12-313-4/+10
| | | | | | | | | | | | | We have to use sizeof(struct nf_ct_tcp_flags) instead of sizeof(u_int16_t) to avoid problems in Intel IXP4xx network processor (ARM big endian). For more information, please see: http://markmail.org/message/afhn66qzyebyf7cs#query:+page:1+mid:7bw756ncuyosv23c+state:results Reported-by: Lutz Jaenicke <ljaenicke@innominate.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: clarify licensing terms of library (GPLv2+)Pablo Neira Ayuso2011-12-3030-96/+136
| | | | | | | | | | | | | | | | This patch is *not* changing the licensing terms of this library (which was initially released under GPLv2 and later on extended to GPLv2+ after contacting all the contributors who kindly agreed to extend it to any later GPL version). Jan says: "In libnetfilter_conntrack, there are many .c files declaring GNU GPL incorporated herein by reference without telling which version(s) exactly apply. Given src/main.c for example is actually GPL-2.0+, the reference made is ambiguous." This patch should definitely clarify this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'master' of git://dev.medozas.de/libnetfilter_conntrackPablo Neira Ayuso2011-12-272-8/+7
|\
| * build: disable implicit .tar.gz archive generation and use POSIX modeJan Engelhardt2011-12-171-1/+2
| |
| * build: use AC_CONFIG_AUX_DIR and stash away toolsJan Engelhardt2011-12-172-4/+2
| |
| * Update .gitignoreJan Engelhardt2011-12-171-3/+3
| | | | | | | | Only ignore these paths if they are a directory.
* | utils: fix expect_get to work with expect_createPablo Neira Ayuso2011-12-241-2/+2
| | | | | | | | | | | | | | expect_get now allows you get the expectation that has been created with expect_create. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | src: export NFCT_HELPER_NAME_MAXPablo Neira Ayuso2011-12-246-14/+17
| | | | | | | | | | | | | | NFCT_HELPER_NAME_MAX is 16, which is the maximum helper name allowed since 2.6.29. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | expect: modify output by moving zone and flags to the end of the linePablo Neira Ayuso2011-12-241-18/+18
| | | | | | | | | | | | | | | | Now, the output of nfexp_snprintf looks like this: 299 proto=6 src=192.168.1.130 dst=130.89.148.12 sport=0 dport=45420 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.1.130 master-dst=130.89.148.12 sport=46368 dport=21 helper=ftp Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | expect: support CTA_EXPECT_HELP_NAMEPablo Neira Ayuso2011-12-247-0/+34
|/ | | | | | | | This patch adds support for CTA_EXPECT_HELP_NAME. We now have the ATTR_EXP_HELPER_NAME attribute. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add nfexp_send()Pablo Neira Ayuso2011-12-082-0/+37
| | | | | | It is like nfct_send() but for expectations, for API symmetry. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: nfexp_snprintf displays mask and master tuple informationPablo Neira Ayuso2011-12-064-14/+47
| | | | | | | | | | | | | | | | This patch adds mask and master tuple information regarding one expectation. This information has been not shown so far. I consider that it is interesting because you can use this information to troubleshoot expectation issues. Moreover, you can know which is the master conntrack that this expectation is attached to. This extends the text-based output for `conntrack -L exp'. This can be considered a backward compatibily issue since existing tools that are parsing this interface may break. But this is not our fault, we provide an API to the conntrack table via libnetfilter_conntrack. People should use those. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: nfexp_snprintf prints expectation timeout if presentPablo Neira Ayuso2011-10-271-2/+14
| | | | | | Otherwise, we don't print it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: fix missing parsing of master tuplePablo Neira Ayuso2011-10-271-6/+15
| | | | | | | The master tuple was not parsed. This patch also fixes an incorrect use of the exp->set field for the expectation and mask tuples. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix missing nfct_copy function not included in doxygen reportPablo Neira Ayuso2011-10-131-4/+0
| | | | | | | | This closes netfilter bugzilla #754: http://bugzilla.netfilter.org/show_bug.cgi?id=754 Reported-by: <abirvalg@lavabit.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: objopt: NO_EFFECTJiri Popelka2011-06-131-1/+1
| | | | | | | | | | | | static analysis (analysis based only on compiling of sources, not based on running of binary) of the code revealed the following problem: conntrack/objopt.c:63: self_assign: Assignment operation "ct->snat.l4max.all = ct->snat.l4max.all" has no effect. Signed-off-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: add nfct_destroy() to all examples in utilsAndrew Beverley2011-05-1411-0/+46
| | | | | | | | | | This patch adds nfct_destroy() to all the examples in the utils folder. Although this may be obvious to some, when I wrote my first code using libnetfilter_conntract, I used the examples but subsequently missed out all the calls to nfct_destroy(). Signed-off-by: Andrew Beverley <andy@andybev.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Linux kernel-style for compilation messagesPablo Neira Ayuso2011-03-151-0/+3
| | | | | | I guess that Jan Engelhardt is going to like this? :-) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: bump version to 0.9.1libnetfilter_conntrack-0.9.1Pablo Neira Ayuso2011-02-242-2/+2
| | | | | | This patch bumps version to 0.9.1 and it bumps the API revision number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix subscript is above array bounds in secctxPablo Neira Ayuso2011-02-241-1/+1
| | | | | | | | | | | | | | > CC parse.lo > parse.c: In function ‘__parse_conntrack’: > parse.c:434:15: warning: array subscript is above array bounds > > struct nfattr *tb[CTA_SECCTX_MAX] > 434: ct->secctx = strdup(NFA_DATA(tb[CTA_SECCTX-1])) > > CTA_SECCTX has value 19, and CTA_SECCTX_MAX is just 1. Reported-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: deprecate low level APIPablo Neira Ayuso2011-02-223-79/+101
| | | | | | | | | | | | This patch deprecates the low level API. This API is not currently used by any known clients (at least, at a quick glance at google). These functions are a problem if we plan to port libnetfilter_conntrack upon libmnl since they contain specific libnfnetlink bits. I have also added __build_query_[ct|exp] to avoid compilation warnings. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: deprecate nfct_sizeof() and nfct_maxsize() functionsPablo Neira Ayuso2011-02-172-2/+6
| | | | | | | | | These functions are evil since they allow the use of memcpy() instead of nfct_copy(). This is a problem because it violates the design principle that the library follows, that is to provide opaque objects in which the client code does not care on the binary layout. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>