summaryrefslogtreecommitdiffstats
path: root/input/flow
Commit message (Collapse)AuthorAgeFilesLines
* src: fix version that -V displaysPablo Neira Ayuso2012-08-031-1/+1
| | | | | | | It was wrong, use VERSION constant which uses the version information available in configure.ac. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* input: NFCT: fix compilation warning with gcc-4.7Pablo Neira Ayuso2012-08-031-2/+0
| | | | | | | | CC ulogd_inpflow_NFCT_la-ulogd_inpflow_NFCT.lo ulogd_inpflow_NFCT.c: In function 'configure_nfct': ulogd_inpflow_NFCT.c:977:28: warning: unused variable 'cpi' [-Wunused-variable] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: fix crash in polling mode if used by two stacksEric Leblond2012-07-201-5/+5
| | | | | | | | | | | | The polling timer initialisation code was put in the configurator code. It was then created for all instances. But only first one has a valid NFCT handle. This was resulting in a crash. This patch moves the timer initialisation in the constructor which is called only once on the main NFCT instance. Signed-off-by: Eric Leblond <eric@regit.org> Reported-by: Gomathivinayagam Muthuvinayagam <sankarmail@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use pkglibdir instead of pkglibexecdir for automakeBjörn Lässig2012-05-181-1/+1
| | | | | | | | | | | This fixes the following problem while running `autoreconf -fi` `pkglibexecdir' is not a legitimate directory for `LTLIBRARIES' variable `ulogd_filter_PRINTPKT_la_SOURCES' is defined but no program or library has `ulogd_filter_PRINTPKT_la' as canonical name (possible typo) Signed-off-by: Björn Lässig <laessig@bitformer.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: add `reliable' config option to enable reliable flow-based loggingPablo Neira Ayuso2012-03-051-1/+18
| | | | | | | | | | | | Reliability comes at the cost of dropping new flows if the destroy event that ctnetlink delivers to us is lost. Under heavy stress this may imply dropping packets, you've been warned. If you do want not to lose one single flow-logging information, enable this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: use nfct_copy() instead of deprecated nfct_sizeof() functionPablo Neira Ayuso2011-02-251-1/+1
| | | | | | | | | | nfct_sizeof() allows memcpy() of ct objects, which violates the library design (that aims to hide binary layout). We use nfct_copy() with the override flag instead as added by libnetfilter_conntrack 0.9.1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use appropriate location for program modulesJan Engelhardt2011-02-011-1/+1
| | | | | | | Modules - since they are dependent on the executable - generally go to libexec/. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* NFCT: fix bug in polling modePablo Neira Ayuso2010-12-091-0/+6
| | | | | | | | | This closes the following bug: http://bugzilla.netfilter.org/show_bug.cgi?id=684 This problem was introduced with the XML output plugin. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: propagate global CFLAGSJan Engelhardt2010-11-051-1/+1
| | | | | | | | | We must not override CFLAGS, because that will break when the user overrides CFLAGS again at make time (which he is entitled to). So, name our CFLAGS regular_CFLAGS, and also include that across all Makefiles so that they are actually uesd for all the code. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: remove unused $(all_includes)Jan Engelhardt2010-11-051-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: remove -fPIC flagJan Engelhardt2010-11-051-1/+1
| | | | | | libtool automatically adds PIC flags as needed. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* NFCT: copy the conntrack object to the plugin oncePablo Neira Ayuso2010-06-171-1/+8
| | | | | | | With this patch, we copy the conntrack object that we propagate to the output plugin instances *only once*. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: fix plugin re-use in different stacksPablo Neira Ayuso2010-06-171-4/+6
| | | | | | | | | | This patch fixes a problem in configurations that use the NFCT plugin as input in several stacks. The first plugin loaded contains the hashtable and other important NFCT private data. Other plugin instances of NFCT are dummies that are only used to store the output keys. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: add new plugin XML to output logs in XMLPablo Neira Ayuso2010-06-171-0/+18
| | | | | | | This patch adds XML that allows to log information in XML for ulogd2. It supports packet and flow-based accounting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: fix reset counters via SIGUSR2 signalPablo Neira Ayuso2010-01-171-3/+52
| | | | | | | This patch fixes a feature that allows to force the logging of the existing entries and reset the counters. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: fix number of options (missing one)Pablo Neira Ayuso2010-01-171-1/+1
| | | | | | | This patch fixes the number of options in NFCT that is actually 8, not 7. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: split event handler if hashtable is used or notPablo Neira Ayuso2010-01-171-28/+39
| | | | | | | | | This patch splits event_handler into two functions: event_handler_hashtable and event_handler_no_hashtable. Thus, we register the appropriate handler during the initialization time. This patch is a cleanup. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: use new hashtable implementation for better performancePablo Neira Ayuso2010-01-171-40/+79
| | | | | | | | This patch replaces the existing hashtable implementation with a newer that provide better performance since it reduces the number of hash computations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: change `pollinterval' behaviourPablo Neira Ayuso2010-01-171-8/+120
| | | | | | | | | | | | | | | This patch adds support for poll-based logging. Basically, ulogd polls from the kernel periodically to log entries. You can use the `pollinterval' option in the configuration file to set the polling period. This patch changes the current behaviour of `pollinterval' that allowed to mix both the event-driven logging with polling periodically from the kernel. I have tried to look for anyone in google (and asking Eric Leblond) using this feature but I found noone. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: cleanup constructor and destructor functionsPablo Neira Ayuso2010-01-111-41/+67
| | | | | | | | This patch cleans up the destructor and the destructor functions in the NFCT plugin. I know, this patch isn't easy to review because it includes too many changes in one. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: avoid spamming report about netlink overrunsPablo Neira Ayuso2009-07-221-1/+9
| | | | | | | This patch reduces the verbosity of the log messages that report netlink overruns. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: add configurable option to set the value of the resynchronization timerPablo Neira Ayuso2009-07-221-8/+15
| | | | | | | | | This patch adds `netlink_resync_timeout' that allows you to set the number of seconds that we wait to perform a resynchronization due to a netlink overrun. This patch changes the default timeout from 2 to 60 seconds (less agressive). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: improve netlink overrun handlingPablo Neira Ayuso2009-07-221-12/+12
| | | | | | | | | | With this patch, we schedule one resynchronization against the kernel conntrack table that will occur in two seconds (still we need a patch to make this configurable). Before this, we scheduled a resynchronization for every overrun, that is very bad in a scenario in which overruns occurs very frequently. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: fix NULL dereference when hashtable is fullPablo Neira Ayuso2009-06-231-0/+9
| | | | | | | | This patch fixes a NULL dereference to the timestamp structure when hashtable_add() fails, for example, because the hashtable is full. Reported-by: Bernhard Schmidt <berni@birkenwald.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Delete timer in destructor function.Eric Leblond2009-02-081-0/+2
| | | | This patch deletes the overrun timer in the destructor function.
* Replace INCLUDES by AM_CPPFLAGS in Makefile.am.Eric Leblond2009-01-221-1/+1
| | | | | This patch fixes autotools warning about deprecated usage of INCLUDES in Makefile.am.
* build: use -avoid-version for modulesJan Engelhardt2009-01-201-2/+2
| | | | | | | The modules are pretty much bound to ulogd, and it does not seem to make sense to specially version these. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: compile fixJan Engelhardt2009-01-181-0/+1
| | | | | | | | | ulogd_inpflow_NFCT.c: In function 'propagate_ct': ulogd_inpflow_NFCT.c:483: error: 'IPPROTO_UDPLITE' undeclared (first use in this function) (and more for IPPROTO_SCTP) Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Fix memory leak in destructor_nfct().Eric Leblond2008-12-091-0/+11
| | | | | This patch fixes a memory leak in the destructor function which was not releasing the memory allocated for each connection tracking entry.
* Fix stop function of NFCT plugin.Eric Leblond2008-12-091-1/+1
| | | | | This patch fixes some crashes in NFCT plugin that were triggered by the call of the destructor_nfct function (during stop).
* add ukey_* function for key assignationPablo Neira Ayuso2008-12-091-106/+53
| | | | | | | | | This patch cleans up the current key assignation by introducing a set of functions ukey_* to set the key value as Eric Leblond and we discussed during the latest Netfilter Workshop. This patch is based on an idea from Holger Eitzenberger. Signed-off-by: Eric Leblond <eric@inl.fr>
* whitespace cleanupEric Leblond2008-06-231-19/+19
|
* Fix NFCT/NFLOG plugin compilation when libraries use non-standard prefix.Eric Leblond2008-06-181-1/+2
| | | | | | | | | Fixes compilation of NFLOG and NFCT plugin when libnetfilter libraries are installed under a non standard prefix. Include path and libs path for libnetfilter_conntrack and libnetfilter_log were not correctly set even if pkg-config found them. Signed-off-by: Eric Leblond <eric@inl.fr>
* Cleanup: fix error messages and indentationEric Leblond2008-06-121-3/+3
| | | | | | | | This patch fixes some messages in the NFCT and NFLOG input plugin (end of line before quote). It also fixes indenting by suppressing some spaces on empty line and replacing spaces by tab. Signed-off-by: Eric Leblond <eric@inl.fr>
* Fix crash when using NFCT with hash_enable=0.regit2008-06-041-1/+1
| | | | | | | | | This patch fixes NFCT when hash_enable is 0. Limitation of treatment to NFCT_DESTROY message type causes usage of the hashtable function and hence a crash because it is not initiated. Signed-off-by: regit <regit@ghlodit.inl.fr> Signed-off-by: Patrick McHardy <kaber@trash.net>
* Modify the code by activating overrun handling if and only if the local hash ↵Eric Leblond2008-06-021-19/+28
| | | | is used (hash_enable=1 which is the default)
* Fill every possible timestamp. It fills START timestamp for NEW packet and ↵Eric Leblond2008-06-021-15/+42
| | | | STOP timestamp for DESTROY packet
* cleanup for key builder and fix IPv6 support and introduce 128-bits typePablo Neira Ayuso2008-06-021-41/+79
| | | | | | This patch cleans up the key building by breaking lines at 80 columns and it fixes the IPv6 support (use of a pointer after free) by introducing a new 128 bit type.
* improve netlink overrun handling of NFCTPablo Neira Ayuso2008-06-021-28/+210
| | | | | | | | | | | | | | | This patch improves the overrun handling. The logic behind this patch consists of two steps: 1) duplicate the netlink buffer size if the size does not goes after the upper boundary. 2) scheduling a resynchronization (in two seconds) with the kernel conntrack table if we hit ENOBUFS. During the resynchronization, the NFCT plugin dumps the current table and purges the objects that do not exist anymore. This patch also introduces two new clauses, the netlink_socket_buffer_size and netlink_socket_buffer_maxsize that set the size of the netlink socket buffer.
* rework NFCT to use a generic hashtablePablo Neira Ayuso2008-06-021-144/+120
| | | | | | | | This patch introduces a generic hashtable to store the nf_conntrack objects. The objects are identified by the original and reply tuples instead of the conntrack ID which is not dumped in the event message of linux kernel < 2.6.25. This patch also fixes the NFCT_MSG_* by NFCT_T_* which is the appropriate message type tag.
* This patch is a port to the new libnetfilter_conntrack API of the NFCT/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-051-64/+82
| | | | | | | plugin. To be able to send IP addresses to the IP2STR and IP2BIN module oob.family and oob.protocol keys have been added. Signed-off-by: Eric Leblond <eric@inl.fr>
* This patch contains two linked modifications in NFCT input plugin:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-03-261-18/+37
| | | | | | | | | - event mask is now configurable though the event_mask configuration variable - event type is now stored in the ct.event output key. This can be used to display the information or to use it to implement some tracking algorithm in userspace. Signed-off-by: Eric Leblond <eric@inl.fr>
* This patch adds support for duplication of the message to be/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-03-251-0/+10
| | | | | | able to use multiple time the same instance of NFCT. Signed-off-by: Eric Leblond <eric@inl.fr>
* - implement a synchronous timer framework/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-191-14/+12
| | | | - fix crash when enabling pollinterval clause in flow-based accounting
* Sends one message for each connection event instead of two/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-191-68/+168
| | | | Signed-off-by: Eric Leblond <eric@inl.fr>
* Ulogd2: fix some indenting/C=EU/ST=EU/CN=Patrick McHardy/emailAddress=kaber@trash.net2008-01-121-19/+19
| | | | | | | The following patch fixes some indenting and typo in various ulogd2 files. Eric Leblond <eric@inl.fr>
* Add a printflow plugin is similar to the PRINTPKT plugin, but for flows. It's/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2006-05-231-0/+8
| | | | output is compatible with the SYSLOG and LOGEMU plugins. (Philip Craig)
* fix some hahstable related bugs:/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2006-01-261-8/+12
| | | | | | | 1) correctly name flow.end.usec 2) initialize 'idle' list_head 3) don't allocate hash table in case hash_use=0 4) fix invalid pointer arithmetic
* introduce NFCT input plugin hash table for start/end timestamps. Based on an/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2006-01-121-16/+294
| | | | | | | | | | | | | | | | | | | | original patch by Christian Hentschel, amended like: 1) the hash table has to be per-instance, since [at least in the future] we can have nfnetlink messages routed from other machines over the network, thus every NFCT instance has to have it's own hash table. 2) Whether or not to use a preallocated table is now a configuration value, as is the number of buckets and max_entries 3) configure_nfct was not used in the struct ulogd_plugin.configure 4) don't put the hashtable buckets in BSS, but rather allocate them dynamically 5) allocate all ct_timestamps (in the preallocated case) at once, rather than malloc()ing each on its own. 6) use official IPFIX fields for flow start and flow end instead of private numbers 7) use llist instead of list (linuxlist.h adds an additional 'l') 8) add lots of TODO items 9) add IPFIX_NF_conntrack_id to header file
* - Cosmetic changes (tab indent struct initializers)/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2006-01-121-18/+18
| | | | - Rename "tcp.[sd]port" into "l4.[sd]port" (Christian Hentschel)