summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* sync-mode: Also cancel flush timer in ALL_FLUSH_CACHESimon Kirby2019-05-121-0/+2
| | | | | | | | | This makes the behaviour of "conntrackd -f" match that of "conntrackd -f internal" with resepect to stopping a timer ("conntrackd -t") from possibly flushing again in the future. Signed-off-by: Simon Kirby <sim@hostway.ca> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Allow protocol number zeroBrian Haley2019-03-201-1/+1
| | | | | | | | | | | /etc/protocols defines protocol zero as 'ip' for IPv4, and 'hopopt' for IPv6, which can be used with conntrack as '-p ip' or '-p hopopt'. However it's equivalent, '-p 0' is considered unsupported. Change the range check in findproto() to allow zero as well. Signed-off-by: Brian Haley <bhaley@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: use strncpy() to unix pathPablo Neira Ayuso2019-03-201-1/+2
| | | | | | | Make sure we don't go over the buffer boundary. Reported-by: Rijnard van Tonder <rvt@cmu.edu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add -o userspace option to tag user-triggered eventsPablo Neira Ayuso2019-02-202-6/+16
| | | | | | | | | | | | | | The following command: # conntrack -E -o userspace & # conntrack -F [DESTROY] tcp 6 src=122.127.186.172 dst=192.168.10.195 sport=443 dport=48232 packets=56 bytes=5313 src=192.168.10.195 dst=122.127.186.172 sport=48232 dport=443 packets=49 bytes=5174 [ASSURED] [USERSPACE] prints the [USERSPACE] tag at the end of the event, this tells users if this event has been triggered by process, eg. via conntrack command invocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use libmnl for conntrack eventsPablo Neira Ayuso2019-02-201-37/+83
| | | | | | Use libmnl instead libnfnetlink infrastructure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: extend nfct_mnl_socket_open() to use it to handle eventsPablo Neira Ayuso2019-02-201-8/+8
| | | | | | Add parameter to nfct_mnl_socket_open() to subscribe to events. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix for implicit-fallthrough warningsPhil Sutter2019-02-134-1/+5
| | | | | | | | Mark fall through cases as such. Note that correctness of those fall throughs have not been verified. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: Drop dead code in nfct_timeout_parse_params()Phil Sutter2019-02-131-14/+0
| | | | | | | | | | | | Due to the first switch() in that function, default case in second one is unreachable. Given that both of them contain the same cases but the first one merely acts as an invalid command barrier (adding no value to the second one), drop the first one to make invalid commands actually hit default case in the second switch(). Fixes: dd73ceecdbe87 ("nfct: Update syntax to specify command before subsystem") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: helpers: dhcpv6: Fix potential array overrunPhil Sutter2019-02-121-1/+1
| | | | | | | | | | The value dhcpv6_msg_type points at is used as index to dhcpv6_timeouts array, so upper boundary check has to treat a value of ARRAY_SIZE(dhcpv6_timeouts) as invalid. Fixes: 36118bfc4901b ("conntrackd: helpers: add DHCPv6 helper") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd.conf.8: fix state filter exampleArturo Borrero Gonzalez2019-01-281-5/+5
| | | | | | | | | Missing 'for TCP' induces errors. This was reported in Debian bug #916138 https://bugs.debian.org/916138 Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use -Wno-sign-compare with autogenerated flex codePablo Neira Ayuso2018-05-091-1/+1
| | | | | | | | | | | | | CC read_config_lex.o read_config_lex.c: In function ‘yy_get_next_buffer’: read_config_lex.c:2101:18: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] for ( n = 0; n < max_size && \ ^ read_config_lex.c:3016:3: note: in expansion of macro ‘YY_INPUT’ YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]), ^~~~~~~~ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: -f family filter does not workRonald Wahl2018-05-091-6/+6
| | | | | | | | | | "conntrack -L -f ipv4" and "conntrack -L -f ipv6" each prints both protocols. This is because the family filtering is now enabled only if filter_mark_kernel_set is true. Fixes: 8b8377163697 ("conntrack: send mark filter to kernel iff set") Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack-tools 1.4.5 releaseconntrack-tools-1.4.5Arturo Borrero Gonzalez2018-05-011-2/+2
| | | | Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
* systemd: default to use libsystemd if build with support for itArturo Borrero Gonzalez2018-04-187-11/+13
| | | | | | | | | | | | | | We may assume that if an user does build conntrackd with such feature, is with the intention to use it. So, if that's the case, default to use it. This eases some downstream use cases when dealing with default configs to be shipped to final users. This could be a mid-point solution, given some users are asking for a full revert of commit c01d0d9138112ec95ee316385ea2687dd94fa4e3. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: reallocate cli testing scriptArturo Borrero Gonzalez2018-04-181-0/+0
| | | | | | | Move this to test/ Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: synproxy supportPablo Neira Ayuso2018-03-243-0/+37
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add TCP flags supportPablo Neira Ayuso2018-03-201-37/+19
| | | | | | | | | | | | | | Back in 2008, there was no TCP flags support in the kernel, hence the workaround was to infer the flags from the TCP state. This patch is implicitly fixing a problem, since the existing RETRANS and UNACK TCP conntrack states plus the _CLOSE_INIT flag that is bogusly infered (to be frank, it was correctly infered back in 2008, but after adding new TCP states, it was not). Let's just use the flags that we get via synchronization messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ARRAY_SIZE definitionPablo Neira Ayuso2018-03-202-2/+4
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd.conf.5: fix sentence about systemdArturo Borrero Gonzalez2018-01-251-2/+2
| | | | | | | Typos, duplicated systemd word in the sentence and 'obviously'. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack.8: refresh manpageArturo Borrero Gonzalez2017-09-271-66/+101
| | | | | | | | | | Refresh manpage, fixing typos, rearranging some sentences, introducing line breaks at max. 80 columns, markup fixes, and so on. Apart of some minor cosmetics fixes, no actual content is changed. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: don't fail on modprobe since the driver might be built-inSteve Langasek2017-08-242-12/+16
| | | | | | | | | | | | | | Any of these nf drivers could be built-ins instead of modules; don't cause the testsuite to fail on modprobe, instead let it proceed and succeed/fail later based on actual test results. Ideally we would check up front if the driver is loaded rather than trying to modprobe and ignoring failures, but there doesn't seem to be a reliable place to check this in the kernel filesystem. Signed-off-by: Steve Langasek <steve.langasek@ubuntu.com> Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: ssdp: fix build with muslStijn Tintel2017-08-241-0/+1
| | | | | | | | | For musl libc to expose the members of `struct tcphdr`, _GNU_SOURCE needs to be defined. Fixes: b61c4543cbde ("conntrackd: cthelper: ssdp: Track UPnP eventing") Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Show multiple CPUs stats from procChieh-Min Wang2017-08-241-16/+18
| | | | | | | | | When read cpu conntrack stats from /proc/net/stat/nf_conntrack, it only shows stats from cpu0. This patch list all cpus' conntrack stats like what `nfexp_stats_cb` did. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: remove warning for -SArturo Borrero Gonzalez2017-08-141-3/+0
| | | | | | | | | | Remove the warning message for the -S option which has been deprecated for years now. Users calling conntrackd with this switch activated will now get an error. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: make the daemon run in RT mode by defaultArturo Borrero Gonzalez2017-06-1210-156/+39
| | | | | | | | | | | | | | | | | | | | | | | In order to prevent netlink buffer overrun, conntrackd is recommended to run at max priority. Make conntrackd to use a RT (SHED_RR) scheduler by default at max priority. This is common among other HA daemons. For example corosync uses SCHED_RR by default. The scheduler configuration option is kept in order to allow admins to perform fine-tuning, but it is deleted from example configuration files. Note that this default sched priority is so high that it makes the nice value useless, so deprecate the nice configuration. Anyway the nice value can be set externally at runtime using nice/renice. The code is moved to the init() routine. In case of error setting the scheduler, the system default will be used. Report a message to the user and continue working. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: deprecate unix backlog configurationArturo Borrero Gonzalez2017-06-069-15/+5
| | | | | | | | | This configuration option doesn't add any value to users. Use the magic value of 100 (i.e, the socket will keep 100 pending connections), which I think is fair enough for what conntrackd can do in the unix socket. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cleanup if failed forkingArturo Borrero Gonzalez2017-06-061-0/+2
| | | | | | | Close the logs and lockfile if error while forking. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: evaluate configuration earlierArturo Borrero Gonzalez2017-06-061-11/+9
| | | | | | | | Run the evaluation step sooner in the conntrackd startup routine. Don't close log or unlink lockfile at this stage. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: remove use of HAVE_INET_PTON_IPV6Nicolas Dichtel2017-06-063-71/+46
| | | | | | | | | | | | | | | | | The goal of this patch is to fix the ipv6 support when conntrackd is cross-compiled. The AC_RUN_IFELSE macro must be avoided as much as possible. See section 6.6 of the gnu autoconf: "If you really need to test for a runtime behavior while configuring, you can write a test program to determine the result, and compile and run it using AC_RUN_IFELSE. Avoid running test programs if possible, because this prevents people from configuring your package for cross-compiling." Let's remove this check and test the returned error to handle the case where ipv6 is not supported (inet_pton() returns -1 when the family is not supported). Reported-by: Zhenlin Zhang <zhenlin.zhang@6wind.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: request resync at startupArturo Borrero Gonzalez2017-05-157-5/+47
| | | | | | | | | If a node goes to live, ask the other for resync at startup. This has to be done usually by hand, but I guess is an operation common enough to add some bits to ease people life here. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: consolidate more code to use resync_send()Arturo Borrero Gonzalez2017-05-152-12/+8
| | | | | | | | | | | These digest_msg() functions can use resync_send() as well. While at it, bring back a call to kernel_resync() in notrack_local() which was lost in a previous commit. Fixes: 131df891f77dc75515d5eabdedd9818105d29f5a ("conntrackd: factorize resync operations") Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: factorize resync operationsArturo Borrero Gonzalez2017-05-086-20/+55
| | | | | | | | | | | Resync operations factorization. There are two: * resync_send --> conntrackd -B (send bulk resync) * resync_req --> conntrackd -n (request resync) Future patches reuse this factorized code. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: factorice tx_queue functionsArturo Borrero Gonzalez2017-05-086-74/+71
| | | | | | | They are shared by both sync-ftfw and sync-notrack. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Support IPv6 NATNeil Wilson2017-03-174-67/+216
| | | | | | | | | | Refactor and improve nat support to allow conntrack to manage IPv6 NAT entries. Refactor and improve conntrack nat tests to include IPv6 NAT. Signed-off-by: Neil Wilson <neil@aldur.co.uk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: CommitTimeout breaks DisableExternalCache set OnPablo Neira Ayuso2017-03-103-0/+25
| | | | | | | | | | | This patch introduces a new evaluate() function that can be used to spot inconsistent configurations. Don't allow CommitTimeout with DisableExternalCache On since this results in EINVAL errors. CommitTimeout makes no sense with no external cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: Remove obsolete rule to catch ambiguous Checksum optionPablo Neira Ayuso2017-03-091-23/+0
| | | | | | | This warning has been there for long time, and the example files we provide already come with the right syntax, so remove this old chunk. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: ssdp: Track UPnP eventingKevin Cernekee2017-02-122-7/+480
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The UPnP Device Architecture spec provides a way for devices to connect back to control points, called "Eventing" (chapter 4). This sequence can look something like: 1) Outbound multicast M-SEARCH packet (dst: 1900/udp) - Create expectation for unicast reply from <any host> to source port 2) Inbound unicast reply (there may be several of these from different devices) - Find the device's URL, e.g. LOCATION: http://192.168.1.123:1400/xml/device_description.xml - Create expectation to track connections to this host:port (tcp) 3) Outbound connection to device's web server (there will be several of these) - Watch for a SUBSCRIBE request - Find the control point's callback URL, e.g. CALLBACK: <http://192.168.1.124:3500/notify> - Create expectation to open up inbound connections to this host:port 4) Inbound connections to control point's web server - The device will send NOTIFY HTTP requests to inform the control point of new events. These can continue indefinitely. Each NOTIFY request arrives on a new TCP connection and may have a different source port. Add the necessary code to create expectations for each of these connections and rewrite the IP in the CALLBACK URL. Tested with and without NAT. Signed-off-by: Kevin Cernekee <cernekee@chromium.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: config: Do not strdup() tokensPablo Neira Ayuso2017-02-121-4/+4
| | | | | | | | We can just remove the strdup() from the lexer, given that we always copy these strings in the parser. Reported-by: Kevin Cernekee <cernekee@chromium.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: Free pktb after useKevin Cernekee2017-02-011-0/+1
| | | | | | | | According to valgrind, this currently leaks ~512B to 2kB for each packet sent to the userspace helper. Signed-off-by: Kevin Cernekee <cernekee@chromium.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: Don't leak nat_tupleKevin Cernekee2017-02-013-0/+3
| | | | | | | | | | nfexp_set_attr() copies |nat_tuple| rather than taking ownership, so it should be freed at the end of the loop. Some of the other helpers (like rpc.c) do this, but it is missing here. Reported-by: Eric Caruso <ejcaruso@chromium.org> Signed-off-by: Kevin Cernekee <cernekee@chromium.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: send mark filter to kernel iff setPablo Neira Ayuso2016-12-231-10/+18
| | | | | | | | | Do not set a mark filter to ctnetlink if the user doesn't explicitly specify this. Fixes: aa925010951e ("conntrack: allow to filter by mark from kernel-space") Reported-by: Joseph Conley <joseph.j.conley@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* config: drop old/obsolete/deprecated conntrackd.conf config optionsArturo Borrero Gonzalez2016-12-042-212/+9
| | | | | | | | | | | | There has been a long adaptation time already, with several conntrack-tools releases in the meantime. Users migrating from an old conntrackd to a current one are required to update their config file. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* systemd: fix missing log.h includeArturo Borrero Gonzalez2016-12-041-0/+1
| | | | | | | | Produces this: warning: implicit declaration of function 'dlog' Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add log message when resync is requested by other nodeArturo Borrero Gonzalez2016-12-012-1/+2
| | | | | | | | | | If a resync is requested with 'conntrackd -n', a log message is printed in the caller node, but no message is printed in the other. Print a message so tracking the behaviour of a cluster is a bit easier. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* helper: remove copy and paste from uapi kernel headerPablo Neira Ayuso2016-11-243-25/+135
| | | | | | | | | Copy and paste of headers is not good, include kernel header that provide the necessary definitions. Cache a copy of nf_conntrack_common.h. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack-tools: update Arturo Borrero Gonzalez email addressArturo Borrero Gonzalez2016-11-102-6/+5
| | | | | | | My email address has changed, let's update it. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: replace fprintf calls with dlog()Arturo Borrero Gonzalez2016-11-096-50/+46
| | | | | | | | | | | | | Review fprintf() and perror() calls and replace them with proper logs, since it now supports being called anytime during runtime. While at it, several messages are fixed, deleting \n, adjusting coding style and some typos. Also, the 'conntrackd cannot start, please review your configuration' is printed before closing the log engine. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: replace error reporting in the config parser with dlog()Arturo Borrero Gonzalez2016-11-091-181/+140
| | | | | | | | | Now that our main log function is able to handle the case of the log engine not being initialised, we can use the general function instead of a custom one in the parser. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* log: introduce a mechanism to know if log was initializedArturo Borrero Gonzalez2016-11-092-1/+9
| | | | | | | | | | | | | | | This will allow to call dlog() function from all the points in the execution at runtime. If the log was not initialized, then we just fprintf and return. By now, we can't init the log engine earlier because we require config from the user, so there is a egg-chicken problem. This means that we can't log parsing messages to logfiles but only to stderr/stdout. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* log: print messages to stdout/sderr if running in console modeArturo Borrero Gonzalez2016-10-283-20/+49
| | | | | | | | | | | | | | | | | | | | | If conntrackd is running in console mode (i.e. in foreground) then we can print the log messages to stdout/stderr. This eases the workflow for admins, since we condensate more info into the same terminal output. Example: % sudo conntrackd -C /etc/conntrackd.conf WARNING: XXXX is an invalid interface [Thu Oct 27 13:57:09 2016] (pid=7581) [notice] disabling internal cache [Thu Oct 27 13:57:09 2016] (pid=7581) [notice] disabling external cache [Thu Oct 27 13:57:09 2016] (pid=7581) [ERROR] can't open channel socket: No such device [Thu Oct 27 13:57:09 2016] (pid=7581) [ERROR] initialization failed ERROR: conntrackd cannot start, please check the logfile for more info Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>