summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* build: remove redundant bison/lex testsJan Engelhardt2010-11-051-8/+6
| | | | | | | AC_PROG_{LEX,YACC} already searches for the programs, so no need to do it again with AC_CHECK_PROGS. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: use AM_YFLAGS instead of overriding YACCJan Engelhardt2010-11-051-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: run autoupdate to replace obsolete constructsJan Engelhardt2010-11-051-4/+3
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: default to not building static librariesJan Engelhardt2010-11-051-0/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: resolve automake warningJan Engelhardt2010-11-051-1/+1
| | | | | | src/Makefile.am:24: whitespace following trailing backslash Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* Add .gitignore filesJan Engelhardt2010-10-312-0/+24
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: no need for error message in PKG_CHECK_MODULESJan Engelhardt2010-10-313-27/+6
| | | | | | | | | | | PKG_CHECK_MODULES already produces its own (and more verbose) messsage when a module cannot be found. Mucking around with CFLAGS and LIBS is also not needed since pkgconfig takes care of providing variables, so let's use them in Makefile.am. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: remove unused $(all_libraries)Jan Engelhardt2010-10-311-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: remove statements without effectJan Engelhardt2010-10-312-6/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: drop unused $(all_includes)Jan Engelhardt2010-10-311-1/+1
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: use modern call syntax for AM_INIT_AUTOMAKEJan Engelhardt2010-10-312-4/+1
| | | | | | | automake options also need to definitely go into configure.ac, otherwise they only apply to a single directory. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: use autoconf-suggested naming of filesJan Engelhardt2010-10-311-0/+0
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* conntrack: allow to listen to all kind of expectation eventsPablo Neira Ayuso2010-10-121-8/+55
| | | | | | | So far, conntrack only allows to listen to events of new expectations. With this patch, we can listen to events of destroyed expectations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix missing line break in conntrack(8) manpagePablo Neira Ayuso2010-10-121-0/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: minor documentation update (two new questions in the FAQ)Pablo Neira Ayuso2010-08-041-1/+27
| | | | | | | This patch includes a minor documentation update with two new questions in the FAQ. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix wrong kernel requirements for TCPWindowTracking in example filesPablo Neira Ayuso2010-08-043-3/+3
| | | | | | | | This patch fixes wrong Linux kernel requirements in the example configuration files. We require a Linux kernel >= 2.6.36 instead of >= 2.6.35 as the files suggest. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: bump version to 0.9.15conntrack-tools-0.9.15Pablo Neira Ayuso2010-07-151-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: update libnetfilter_conntrack dependency (>= 0.0.102)Pablo Neira Ayuso2010-07-151-1/+1
| | | | | | | We require the latest libnetfilter_conntrack version to fix several bugs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: warn on TCPWindowTracking option (it requires kernel >= 2.6.35)Pablo Neira Ayuso2010-07-153-0/+3
| | | | | | | This patch adds a comment on the TCPWindowTracking option to warn that this will be supported since the Linux kernel 2.6.35. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix parsing of NAT sequence adjustment in synchronization messagesPablo Neira Ayuso2010-07-131-5/+5
| | | | | | | | | | This patch fixes a bug that results in an incorrect parsing of the NAT sequence adjustment in synchronization messages. Spotted by Adam Gundy in the following message that was sent to the netfilter ML: http://marc.info/?l=netfilter&m=127894708222913&w=2 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: replace cryptic `mfrm' by `malformed' in `-s'Mohit Mehta2010-07-091-3/+3
| | | | | | | | | | | Looking at the output of `conntrackd -s`; I didn't know what 'mfrm' meant under the 'message sequence tracking' section so I had to look up the code for this. While doing so, I replaced 'mfrm' with 'malformed' in the output since I thought other users might be confused as well as I was looking at that word. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: setup event reliability after handler creationPablo Neira Ayuso2010-07-071-12/+13
| | | | | | | This patch enables the event reliability in an early stage of the event handler initialization. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: open event handler once cache has been populatedPablo Neira Ayuso2010-07-071-13/+18
| | | | | | | | | | | | | With this patch, we open the event handler once the internal cache (if any) is populated. This reduces the chances of a possible premature overrun if we lauch conntrackd in a busy firewall. However, we may still start with an internal cache that may differ a bit from the once in the kernel. This patch has no impact in setups where conntrackd is started in a spare firewall. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: enforce strict logic for NetlinkBufferSize[*] clausesMohit Mehta2010-07-071-14/+20
| | | | | | | | | | | | | | | - NetlinkBufferSize value passed to the kernel gets doubled [see SO_RCVBUF in net/core/sock.c]; it's halved now before it gets sent to the kernel. This ensures that daemon starts up with a netlink socket buffer size equal to the value set for NetlinkBufferSize in configuration file. - Previously, netlink socket buffer size would only stop increasing after it had increased beyond NetlinkBufferSizeMaxGrowth value. With this commit netlink socket buffer size increases as long as it is less than or equal to NetlinkBufferSizeMaxGrowth value. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add zone supportPablo Neira Ayuso2010-07-054-24/+50
| | | | | | | | This patch adds `--zone' to the command line tool. This adds the missing user-space support for Patrick's McHardy iptables CT target. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix ICMPv6 supportPablo Neira Ayuso2010-07-015-1/+5
| | | | | | | | | | | This patch fixes several minor nitpicks to support IPv6 failover: * ICMPv6 type/code/id were missing in synchronization messages. * The use of '-' as string in the configuration file was not allowed. * Include example in configuration file under doc/. Reported-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: update error message for max netlink socket size reachedMohit Mehta2010-07-011-2/+2
| | | | | | | It must refer to NetlinkBufferSize[*] instead of "SocketBufferSize[*]. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: cleanup parsing of the NAT argumentsPablo Neira Ayuso2010-07-011-12/+19
| | | | | | | | | | | | | | | This patch cleans up nat_parse() and it also displays nicer error message for malformed arguments. % conntrack -L --src-nat :80 conntrack v0.9.14 (conntrack-tools): No IP specified Try `conntrack -h' or 'conntrack --help' for more information. % conntrack -L --src-nat 1.1.1.1: conntrack v0.9.14 (conntrack-tools): No port specified after `:' Try `conntrack -h' or 'conntrack --help' for more information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix `conntrack --[src|dst|any]-nat IP:PORT' if port mismatchesPablo Neira Ayuso2010-07-012-0/+20
| | | | | | | | This patch fixes the filtering if the IP matches an entry but the PORT does not matches. Without this patch, the entry is shown when it should be not. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: --[src|dst|any]-nat requires IP:PORT as argumentPablo Neira Ayuso2010-07-012-3/+5
| | | | | | | This patch restricts the behaviour that we previously introduced in 142606c60808b3ab0496155ac3d086765e6baef3. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix `conntrack --any-nat 1.1.1.1' filteringPablo Neira Ayuso2010-07-011-2/+2
| | | | | | | This patch adds the missing bits to allow to filter with --any-nat based on the IP address. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix `conntrack --src-nat 1.1.1.1' if PAT appliedPablo Neira Ayuso2010-07-011-6/+6
| | | | | | | | This patch fixes another scenario in which the flow has some PAT mangling and we passed the src-nat address that we want to use to perform the filtering. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix `conntrack --src-nat 3.3.3.3' and similarPablo Neira Ayuso2010-07-011-4/+14
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix bogus NATted flows in filteringPablo Neira Ayuso2010-07-011-4/+8
| | | | | | | | | | | With this patch, conntrack does not show bogus entries that have no NAT applied due to a relaxed checking. conntrack -L --src-nat :80 tcp 6 342824 ESTABLISHED src=XX.214.188.80 dst=66.XX.7.180 sport=80 dport=13749 packets=4 bytes=6000 [UNREPLIED] src=66.XX.7.180 dst=XX.214.188.80 sport=13749 dport=80 packets=0 bytes=0 mark=0 secmark=0 use=1 conntrack v0.9.14 (conntrack-tools): 1 flow entries have been shown. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: re-fix inconsistent display with `--src-nat' and `--dst-nat'Pablo Neira Ayuso2010-07-011-46/+30
| | | | | | | | | | In 142606c60808b3ab0496155ac3d086765e6baef3, I re-introduced the inconsistent behaviour that I described in 85f94171a71880c744f265268f33ad58819caa74. Great. This patch fixes this again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add testsuite for NAT filtering optionsPablo Neira Ayuso2010-07-011-0/+36
| | | | | | This patch adds the testsuite for the NAT filtering options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add `--any-nat' to filter any NATted flowPablo Neira Ayuso2010-07-013-23/+74
| | | | | | | This patch adds the --any-nat option that allows to display src-NATted OR dst-NATted flows. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix port filter with `--src-nat' and `--dst-nat'Pablo Neira Ayuso2010-06-281-31/+39
| | | | | | | | This patch allows the following command to filter port-based NAT: $ conntrack -L --dst-nat :9999 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: put all the commands and options code togetherPablo Neira Ayuso2010-06-222-262/+264
| | | | | | | | This patch is a cleanup, it puts all the commands and options code together. This makes easier and less error-prone the task to add new commands and options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: expand array that maps option-flags to option-namesPablo Neira Ayuso2010-06-221-3/+23
| | | | | | | This patch is a cleanup, it expands an array that contains the correspondence between the option-flags and the option-names. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: complete TCP window scale supportPablo Neira Ayuso2010-06-171-0/+4
| | | | | | | | | | In commit 56817d1c0cc30bcd65c56c2f73634b256603cc4d, I added the TCP window scale factor support but it was incomplete. We have to set the IP_CT_TCP_FLAG_WINDOW_SCALE flag to update the td_scale field via ctnetlink. Check nlattr_to_tcp(...) function in nf_conntrack_proto_tcp.c for more details. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: `-L --src-nat --dst-nat' filter using AND, not OR logicPablo Neira Ayuso2010-06-171-3/+17
| | | | | | | | | | | | The patch that I committed in 2e06d62d341fdf936dbc1fa944d5e03f761aaf0e was incomplete. With it, `-L --src-nat --dst-nat' shows source-natted OR destination-natted flows. This patch changes the behaviour to show source-natted AND destination-natted flows. This is the consistent behaviour that we expect from conntrack (this is how it works for other options indeed). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix `conntrack -L --src-nat --dst-nat' (second try)Pablo Neira Ayuso2010-06-171-13/+9
| | | | | | This patch fixes the filtering with --src-nat and --dst-nat options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: revert fix `-L --src-nat --dst-nat'Pablo Neira Ayuso2010-06-171-9/+13
| | | | | | | This patch reverts 0865d22af0ec5876f721d44c90ac898fdfa435aa since it breaks conntrack listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: `-i -x' does not display internal cache in XMLMohit Mehta2010-06-151-1/+1
| | | | | | | | `conntrackd -i -x' does not display internal cache in XML, this patch fixes the problem. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix `-L --src-nat --dst-nat'Pablo Neira Ayuso2010-06-101-13/+9
| | | | | | | | Since > 0.9.6, the conntrack listing with the options --src-nat and --dst-nat does not work. This patch fixes the problem. Reported-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: description on how to block traffic with conntrack was incompletePablo Neira Ayuso2010-05-101-2/+7
| | | | | | | | | This patch completes the documentation with the following discussion that took place in the mailing list. http://marc.info/?l=netfilter&m=127335152521674&w=2 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: split __run() routine for poll and event-driven modesPablo Neira Ayuso2010-02-281-71/+105
| | | | | | | | This patch splits the __run() routine into two functions, run_polling() and run_events() that are selected once in run-time. We save one branch in a loop that intensively executed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: PollSecs goes in the General clause for statisticsPablo Neira Ayuso2010-02-281-12/+12
| | | | | | | | This patch fixes the configuration file that includes an example of the PollSecs clause in Stats. This is wrong since it should go in the General clause. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: option `-t' in on the same line as `-m' in manpagePablo Neira Ayuso2010-02-261-0/+1
| | | | | | | | | From Richard Lucassen: > Btw: if you search the "-m --mask" option in the manpage, you'll see a > cosmetic typo: this option is on the same line as "-t --timeout" Reported-by: Richard Lucassen <reply5@xaq.nl> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>