summaryrefslogtreecommitdiffstats
path: root/src/conntrack
Commit message (Collapse)AuthorAgeFilesLines
* conntrack: labels: labelmap_new: make sure errno is 0 when no labels are foundFlorian Westphal2013-07-111-1/+3
| | | | | | | | | | | | | | nfct_labelmap_new returns NULL on failure, e.g. when file cannot be opened. It will also fail if no labels have been parsed, and in this case, content of errno is random. Avoid it by making sure that errno is re-set when no labels were found. While at it, also change ptr test when parsing so reviewers don't need to triple check that this cannot result in out-of-bounds read. Reported-by: Afschin Hormozdiary <Afschin.Hormozdiary@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: api: add nfct_snprintf_labelsFlorian Westphal2013-07-044-7/+118
| | | | | | | | | | | | | | | | | | | | nfct_snprintf doesn't print connlabels, as they're system specific and can easily generate lots of output. This adds a new helper function, nfct_snprintf_labels. It behaves like nfct_snprintf, except that the label names in the labelmap whose bits are contained in connlabel attribute bitset are added to the buffer. output looks like this: output looks like this: ... mark=0 use=1 labels=eth0-in,eth1-in or <labels> <label>eth0-in</label> <label>eth1-in</label> </labels> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: labels: skip labels with non-alnum charactersFlorian Westphal2013-06-301-1/+27
| | | | | | | | | | | | Can always lift this restriction later but for now enforce strict label naming. This is mainly to make sure that e.g. using conntrack ... -o xml,connlabels will output the expected format, without nasty surprises. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: connlabel: remove useless testFlorian Westphal2013-06-181-2/+2
| | | | | | Can't be zero, it was already tested. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: CONNLABELS are not a nested attributeFlorian Westphal2013-06-181-9/+5
| | | | | | | This fixes construction of the conntrack object when CTA_LABEL attribute is present. Signed-off-by: Florian Westphal <fw@strlen.de>
* connlabel: fix NULL deref on malloc failureFlorian Westphal2013-06-061-1/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: nfct_cmp: also compare labelsFlorian Westphal2013-06-051-0/+49
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack, expect: fix _cmp api with STRICT checkingFlorian Westphal2013-06-021-1/+5
| | | | | | | | | | | | | Normal comparision succeeds when the _common_ attribute subset have same values. When STRICT matching is specified, the comparision should succeed only when both objects have same attribute subset and attribute values match. However, STRICT comparision often fails as an attribute missing in both objects is erronously considered an error. Signed-off-by: Florian Westphal <fw@strlen.de>
* libnetfilter_conntrack: don't ignore ATTR_CONNLABELSAfschin Hormozdiary2013-05-202-0/+51
| | | | | | | | | | | | | | The libnfnetlink based backend 'build.c' currently ignores ATTR_CONNLABELS and ATTR_CONNLABELS_MASK. The libmnl based backend 'build_mnl.c' instead handles both attributes correct. Add function to set CTA_LABELS and CTA_LABELS_MASK if required. Signed-off-by: Afschin Hormozdiary <Afschin.Hormozdiary@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* api: add CTA_LABEL_MASK attribute handlingFlorian Westphal2013-05-066-5/+40
| | | | | | | allows to set/clear only a subset of the in-kernel label set, e.g. "set bit 1 and do not change any others". Signed-off-by: Florian Westphal <fw@strlen.de>
* api: add connlabel api and attributeFlorian Westphal2013-05-069-2/+392
| | | | | | | | | | | | | | | | | | | | | | adds new labelmap api to create a name <-> bit mapping from a text file (default: /etc/xtables/connlabel.conf). nfct_labelmap_new(filename) is used to create the map, nfct_labelmap_destroy() releases the resources allocated for the map. Two functions are added to make map lookups: nfct_labelmap_get_name(map, bit) returns the name of a bit, nfct_labelmap_get_bit returns the bit associated with a name. The connlabel attribute is represented by a nfct_bitmask object, the nfct_bitmask api can be used to test/set/get individual bits ("labels"). The exisiting nfct_attr_get/set interfaces can be used to read or replace the existing labels associated with a conntrack with a new set. Signed-off-by: Florian Westphal <fw@strlen.de>
* api: add nfct_bitmask objectFlorian Westphal2013-05-061-0/+119
| | | | | | | | | | | | In order to use generic getter/setter API with upcoming conntrack label extension, add helper functions to set/test/unset bits in a vector of arbitrary size. Conntrack labels will then be encoded via nfct_bitmask object. Original idea from Pablo Neira Ayuso. Signed-off-by: Florian Westphal <fw@strlen.de>
* Fix logic typo in cmp_secctxThomas Jarosch2012-12-271-1/+1
| | | | | | | | cppcheck reported: [src/conntrack/compare.c:364] -> [src/conntrack/compare.c:364]: (style) Same expression on both sides of '||'. Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix nfct_clone with certain attribute data typesFlorian Westphal2012-11-283-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | some attributes are pointers to malloc'd objects. Simply copying the pointer results in use-after free when the original or the clone is destroyed. Fix it by using nfct_copy instead of memcpy and add proper test case for cloned objects: - nfct_cmp of orig and clone should return 1 (equal) - freeing both the original and the clone should neither leak memory nor result in double-frees. the testsuite changes revealed a few more problems: - ct1->timeout == ct2->timeout returned 0, ie. same timeout was considered "not equal" by nfct_cmp - secctx comparision causes "Invalid address" valgrind warnings when pointer is NULL - NFCT_CP_OVERRIDE did not handle helper attribute and erronously freed ct1 secctx memory. While at it, bump qa_test data dummy to 256 (else, valgrind complains about move-depends-on-uninitialized-memory). Lastly, fix compilation of test_api by killing bogus ATTR_CONNLABEL. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix BPF code for IPv6 filtering in case of NFCT_FILTER_LOGIC_POSITIVEPablo Neira Ayuso2012-08-201-9/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 4b6df76 conntrack: fix autogenerated BPF code for IPv6 filtering aimed to fix a bug the IPv6 BPF filtering. However, it didn't fix it for NFCT_FILTER_LOGIC_POSITIVE case since jump is still miscalculated. This chunk below shows the BPF code to filter IPv6 address 2:4:6:: {0x00020004, 0x00060000, 0x0, 0x0 } in case that NFCT_FILTER_LOGIC_POSITIVE is used, ie. if that address matches, accept the event. (0032) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000004 (0033) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0034) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=09 k=00020004 [ this above compares second 4 bytes with 00020004, if comparison fails it jumps to 003e ] (0035) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000008 (0036) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0037) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=06 k=00060000 [ this above compares second 4 bytes with 00060000, if comparison fails it jumps to 003e ] (0038) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=0000000c (0039) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (003a) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=03 k=00000000 [ this above compares third 4 bytes with 00000000, if comparison fails it jumps to 003e ] (003b) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000010 (003c) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (003d) code= BPF_JMP|BPF_JEQ|BPF_K jt=01 jf=00 k=00000000 [ this above compares last 4 bytes with 00000000, if comparison succeded it jumps to 003f, which means, accept event ] (003e) code= BPF_RET|BPF_K jt=00 jf=00 k=00000000 ---- final verdict ---- (003f) code= BPF_RET|BPF_K jt=00 jf=00 k=ffffffff Just for the record: This chunk below shows the BPF code to filter IPv6 address 2:4:6:: {0x00020004, 0x00060000, 0x0, 0x0 } in case that NFCT_FILTER_LOGIC_NEGATIVE is used, ie. if that address matches, drop the event. [...] (0032) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000004 (0033) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0034) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=09 k=00020004 [ this above compares first 4 bytes with 00020004, if comparison fails it jumps to 003e ] (0035) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000008 (0036) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0037) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=06 k=00060000 [ this above compares second 4 bytes with 00060000, if comparison fails it jumps to 003e ] (0038) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=0000000c (0039) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (003a) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=03 k=00000000 [ this above compares third 4 bytes with 00000000, if comparison fails it jumps to 003e ] (003b) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000010 (003c) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (003d) code= BPF_JMP|BPF_JEQ|BPF_K jt=01 jf=00 k=00000000 [ this above compares last 4 bytes with 00000000, if comparison succeded it jumps to 003e ] (003e) code= BPF_JMP|BPF_JA jt=00 jf=00 k=00000001 (003f) code= BPF_RET|BPF_K jt=00 jf=00 k=00000000 [ default action specified by 003e is to drop the event ] Tested-by: Eric Leblond <eric@regit.org> Reported-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix autogenerated BPF code for IPv6 filteringPablo Neira Ayuso2012-07-251-9/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BPF code generated for IPv6 filtering was wrong. Assuming you want to allow all traffic except ::1, the filter that libnetfilter_conntrack generates for the IPv6 address part looks like: [...] (0032) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000004 (0033) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff (0034) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=0a k=00000000 (0035) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000008 [0] (0036) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff [1] (0037) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=07 k=00000000 [2] (0038) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=0000000c [3] (0039) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff [4] (003a) code= BPF_JMP|BPF_JEQ|BPF_K jt=00 jf=04 k=00000000 [5] (003b) code= BPF_LD|BPF_W|BPF_IND jt=00 jf=00 k=00000010 [6] (003c) code= BPF_ALU|BPF_AND|BPF_K jt=00 jf=00 k=ffffffff [7] (003d) code= BPF_JMP|BPF_JEQ|BPF_K jt=01 jf=00 k=00000001 [8] (003e) code= BPF_JMP|BPF_JA jt=00 jf=00 k=00000001 [9] (003f) code= BPF_RET|BPF_K jt=00 jf=00 k=00000000 [A] Line 32 loads the first 4 bytes for the 32 bytes IPv6 address, then line 33 performs the binary AND with the first 4 bytes of the mask. Line 34 evaluated false for the case 2::1 that Eric reported (since 0x2 is not 0x0). Thus, jumping to line 3f that returns reject. However, 2::1 should be allowed. This false-jump case depends on the logic we're using, for the negative logic case, the jump offset is 9 to accept it. In the positive case (ie. accept this event message if matching happens), it has to be 10 (A), to reject it. Reported-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: more verbose debugging for BPF filter generationPablo Neira Ayuso2012-07-251-14/+86
| | | | | | | | | | | | This patch adds more verbose output for the automatic BPF filter generation to sieve netlink messages that are receive via ctnetlink. This code is disabled by default, only useful for debugging so far. It shouldn't be hard to provide a function to explicitly print instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add nfct_set_attr_l and ATTR_HELPER_INFOPablo Neira Ayuso2012-06-266-72/+204
| | | | | | | | | | | | | | This adds the ATTR_HELPER_INFO that can be used to send binary data that will be attached to the conntrack. This is useful for the user-space connection tracking support. This patch also adds a new interface: nfct_set_attr_l(attr, type, value, length); that is used to set the variable length helper information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add new API to build/parse ctnetlink messages using libmnlPablo Neira Ayuso2012-05-262-2/+2
| | | | | | | | This patch adds support to build and to parse netlink messages from/to one user-space nf_conntrack object. It uses libmnl, thus libnetfilter_conntrack now depends on this library. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add new API to build/parse ctnetlink messages using libmnlPablo Neira Ayuso2012-05-263-0/+1409
| | | | | | | | | | | | | | | This patch adds support to build and to parse netlink messages from/to one user-space nf_conntrack object. It uses libmnl, thus libnetfilter_conntrack now depends on this library. This is the first patch in the direction of removing the dependency on the veteran libnfnetlink. I have decided to update LIBVERSION in this patch. I know it's recommended to do this before releasing the software. I prefer to do this so snapshot packages get the correct LIBVERSION. Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
* snprintf: print conntrack helper name, tooFlorian Westphal2012-05-202-0/+27
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix new ATTR_GRP_[ORIG|REPL]_ADDR_[SRC|DST]Pablo Neira Ayuso2012-04-293-80/+105
| | | | | | | | | | The previous patch was incomplete. This fixes several issues with it like the IPV4 and IPV6 address are mutually exclusive, thus, the getter operation works. No sane way to support the setter operation correctly, thus, it's been documented that it has no effect. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add new ATTR_GRP_[ORIG|REPL]_ADDR_[SRC|DST] attributePablo Neira Ayuso2012-04-273-1/+77
| | | | | | | | | | | | | | | | | | | | This allows you to set and to get the address for both IPv4 and IPV6 using the same interface. This can simplify much redundant code that needs to support both protocols. This relies on some fixed layout union: union nfct_attr_grp_addr { u_int32_t ip; u_int32_t ip6[4]; u_int32_t addr[4]; }; But I don't see this library will support anything different from IPv4 and IPv6 as layer 3 protocol. If that happens and some point, we can add some new attribute group and deprecate this one. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix wrong building of ICMP reply tuplePablo Neira Ayuso2012-03-231-4/+1
| | | | | | | | | | | | For ICMP flows: conntrack -U -s 192.168.1.114 -m 1 returned -EINVAL. It seems we were including the reply tuple imcompletely. Reported-by: <abirvalg@lavabit.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for CTA_MARK_MASK and filtered dumpingPablo Neira Ayuso2012-02-093-2/+129
| | | | | | | | This patch adds the infrastructure to allow filtered dumping. See utils/conntrack_dump_filter.c for instance. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add XML support for nfexp_snprintf()Pablo Neira Ayuso2012-01-221-38/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Example of the XML output: <flow type="new"> <layer3 protonum="2" protoname="IPv4"> <expected> <src>192.168.0.2</src> <dst>192.168.1.2</dst> </expected> <mask> <src>255.255.255.255</src> <dst>255.255.255.255</dst> </mask> <master> <src>192.168.0.2</src> <dst>192.168.1.2</dst> </master> </layer3> <layer4 protonum="6" protoname="tcp"> <expected> <sport>0</sport> <dport>41739</dport> </expected> <mask> <sport>0</sport> <dport>65535</dport> </mask> <master> <sport>36390</sport> <dport>21</dport> </master> </layer4> <meta> <helper-name>ftp</helper-name> <timeout>300</timeout> <zone>0</zone> </meta> </flow> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add nfexp_cmpPablo Neira Ayuso2012-01-041-5/+5
| | | | | | | | | This patch adds nfexp_cmp that allows you to compare two expectation objects. This includes the extension of test_api for this new function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix set operation for master IPv6 src and dstPablo Neira Ayuso2012-01-041-2/+2
| | | | | | | | They seem to be accidentally swapped. Fix this. Spotted by qa/test_api. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: put nf_expect and nf_conntrack into dietPablo Neira Ayuso2012-01-0412-488/+481
| | | | | | | | | | | | | | | | Now, struct nf_expect takes only 192 bytes, instead of 1KB. struct nf_conntrack takes 296 bytes instead of 328 bytes. The size of the nf_expect structure has been reduced by rearranging the layout of the nf_conntrack structure. For the nf_conntrack case, this removes the allocation of room for attributes that the master tuple does not use (more specifically, the NATseq bytes). This patch modifies the binary layout of struct nf_conntrack. This should not be a problem since the definition of this object is opaque (it can be only accessed via get/set API). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix size of CTA_PROTOINFO_TCP_FLAGS_ORIGINAL in ARMPablo Neira Ayuso2011-12-312-4/+4
| | | | | | | | | | | | | We have to use sizeof(struct nf_ct_tcp_flags) instead of sizeof(u_int16_t) to avoid problems in Intel IXP4xx network processor (ARM big endian). For more information, please see: http://markmail.org/message/afhn66qzyebyf7cs#query:+page:1+mid:7bw756ncuyosv23c+state:results Reported-by: Lutz Jaenicke <ljaenicke@innominate.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: clarify licensing terms of library (GPLv2+)Pablo Neira Ayuso2011-12-3017-51/+85
| | | | | | | | | | | | | | | | This patch is *not* changing the licensing terms of this library (which was initially released under GPLv2 and later on extended to GPLv2+ after contacting all the contributors who kindly agreed to extend it to any later GPL version). Jan says: "In libnetfilter_conntrack, there are many .c files declaring GNU GPL incorporated herein by reference without telling which version(s) exactly apply. Given src/main.c for example is actually GPL-2.0+, the reference made is ambiguous." This patch should definitely clarify this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: export NFCT_HELPER_NAME_MAXPablo Neira Ayuso2011-12-243-6/+6
| | | | | | | NFCT_HELPER_NAME_MAX is 16, which is the maximum helper name allowed since 2.6.29. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: nfexp_snprintf displays mask and master tuple informationPablo Neira Ayuso2011-12-061-11/+21
| | | | | | | | | | | | | | | | This patch adds mask and master tuple information regarding one expectation. This information has been not shown so far. I consider that it is interesting because you can use this information to troubleshoot expectation issues. Moreover, you can know which is the master conntrack that this expectation is attached to. This extends the text-based output for `conntrack -L exp'. This can be considered a backward compatibily issue since existing tools that are parsing this interface may break. But this is not our fault, we provide an API to the conntrack table via libnetfilter_conntrack. People should use those. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix missing nfct_copy function not included in doxygen reportPablo Neira Ayuso2011-10-131-4/+0
| | | | | | | | This closes netfilter bugzilla #754: http://bugzilla.netfilter.org/show_bug.cgi?id=754 Reported-by: <abirvalg@lavabit.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: objopt: NO_EFFECTJiri Popelka2011-06-131-1/+1
| | | | | | | | | | | | static analysis (analysis based only on compiling of sources, not based on running of binary) of the code revealed the following problem: conntrack/objopt.c:63: self_assign: Assignment operation "ct->snat.l4max.all = ct->snat.l4max.all" has no effect. Signed-off-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix subscript is above array bounds in secctxPablo Neira Ayuso2011-02-241-1/+1
| | | | | | | | | | | | | | > CC parse.lo > parse.c: In function ‘__parse_conntrack’: > parse.c:434:15: warning: array subscript is above array bounds > > struct nfattr *tb[CTA_SECCTX_MAX] > 434: ct->secctx = strdup(NFA_DATA(tb[CTA_SECCTX-1])) > > CTA_SECCTX has value 19, and CTA_SECCTX_MAX is just 1. Reported-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: deprecate low level APIPablo Neira Ayuso2011-02-221-42/+50
| | | | | | | | | | | | This patch deprecates the low level API. This API is not currently used by any known clients (at least, at a quick glance at google). These functions are a problem if we plan to port libnetfilter_conntrack upon libmnl since they contain specific libnfnetlink bits. I have also added __build_query_[ct|exp] to avoid compilation warnings. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: deprecate nfct_sizeof() and nfct_maxsize() functionsPablo Neira Ayuso2011-02-171-0/+4
| | | | | | | | | These functions are evil since they allow the use of memcpy() instead of nfct_copy(). This is a problem because it violates the design principle that the library follows, that is to provide opaque objects in which the client code does not care on the binary layout. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add NFCT_CP_OVERRIDE flag for nfct_copy()Pablo Neira Ayuso2011-02-172-0/+15
| | | | | | | | Thus, we have a fast version of nfct_copy() which allows to copy the destination to the origin. After this call, the destination is a clone of the origin. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix segfault in nfct_copy() if secctx of origin is not setPablo Neira Ayuso2011-02-171-2/+5
| | | | | | This problem was caught by qa/test_api. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add timestamp supportPablo Neira Ayuso2011-02-177-25/+249
| | | | | | | | | | | | This patch adds the connection tracking extension that allows conntrack timestamping. This requires a Linux kernel >= 2.6.38. We have now 65 attributes, we need 96 bits to store what attributes are set in the objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* api: fix use-after-free bug in nfct_destroy()Pablo Neira Ayuso2011-01-211-1/+1
| | | | | | | | | | This patch fixes an embarasing a use-after-free in nfct_destroy() that was introduced by myself in: http://git.netfilter.org/cgi-bin/gitweb.cgi?p=libnetfilter_conntrack.git;a=commit;h=fdda1474cc8654430f245b7f01c30e8ff171fa60 Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for CTA_SECCTXPablo Neira Ayuso2011-01-168-0/+63
| | | | | | | This patch adds support for the new attribute CTA_SECCTX that supersedes CTA_SECMARK. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use -Wall across the entire sourceJan Engelhardt2010-12-301-2/+0
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Merge branch 'master' of git://dev.medozas.de/libnetfilter_conntrackPablo Neira Ayuso2010-12-2110-17/+17
|\
| * src: declare non-modified data as constJan Engelhardt2010-11-0910-17/+17
| | | | | | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* | src: replace CTA_PROTOINFO_DCCP_SEQ by CTA_PROTOINFO_DCCP_HANDSHAKE_SEQPablo Neira Ayuso2010-12-182-3/+3
|/ | | | | | | | | | | This patch uses CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ instead which is the name that is used in the Linux kernel header. Thus, both the headers and the internal copy for the library are in sync. This problem was probably introduced at the time that we added support for the DCCP handshake sequence number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to use nfct handler for conntrack and expectations at the same timePablo Neira Ayuso2010-11-084-74/+49
| | | | | | | | | | This patch re-works the callback handling to allow the use the same socket to send/receive commands and listen to events of both conntrack and expectation subsystems. Now you can register one callback for conntrack and one for expectation with the same handler with no problems (before this patch, this was not possible, you required two different handlers). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: no need for error message in PKG_CHECK_MODULESJan Engelhardt2010-10-301-2/+1
| | | | | | | | | | PKG_CHECK_MODULES already produces its own (and more verbose) messsage when a module cannot be found. Mucking around with CFLAGS and LIBS is also not needed since pkgconfig takes care of providing variables, so let's use them in Makefile.am. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: remove -fPIC flagJan Engelhardt2010-10-301-1/+1
| | | | | | libtool automatically adds PIC flags as needed. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>