summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* conntrackd: add systemd supportArturo Borrero2015-11-1714-3/+183
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds basic systemd support. The feature can be enabled/disabled at configure time: ./configure --disable-systemd Also, at runtime in conntrackd.conf General { Systemd on|off } (by default it's enabled both at runtime and at configure time) * tell systemd about conntrackd readiness: When conntrackd starts, it will send systemd the data "READY=1". At the point the data is sent, conntrackd is fully ready to work (configuration was OK, sockets OK, et all), so other actions depending on conntrackd can be safely chained in the machine boot process. * tell systemd about conntrackd shutting down: If the admin kills conntrackd with `conntrackd -k', the data "STOPPING=1" will be send to systemd so it learns about the daemon shutting down. Same for manual signals. * watchdog support: The admin can configure systemd to watch the conntrackd daemon and perform some actions if conntrackd dies: restart it, reboot the machine, etc... Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure.ac: improve feature selectionArturo Borrero2015-11-011-2/+2
| | | | | | | | Let's improve feature selection with feedback from Jan Engelhardt and Pablo Neira Ayuso. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add zone direction supportDaniel Borkmann2015-09-294-27/+70
| | | | | | | | | | | | | | | | This patch adds support for zone directions. Since all options have the orig/reply as a prefix, I named it --orig-zone and --reply-zone to stay consistent with the rest of the cmdline options. As for the option chars, there was no unallocated reasonable combination, thus only long options are officially exposed in the help, similarly as in other cases. Test suite results, after patch: OK: 79 BAD: 0 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack-tools 1.4.3 releaseconntrack-tools-1.4.3Pablo Neira Ayuso2015-09-081-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: update syntax in documentationPablo Neira Ayuso2015-09-084-7/+7
| | | | | | | Since dd73ceecdbe8 ("nfct: Update syntax to specify command before subsystem") the command comes before the object type. Update documentation accordingly. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: Update syntax to specify command before subsystemPablo Neira Ayuso2015-08-2615-169/+225
| | | | | | | | | | | | | | | | | This patch gets the nfct syntax in sync with nft so it looks like this: nfct <add|delete|...> object ... instead of: nfct object <add|delete|...> ... This patch retains backward compatibility so you can still use the old syntax. The manpage and tests have been also updated to promote the adoption of this syntax. We should have little existing clients of this tool as we can only use this to configure the cttimeout and cthelper infrastructures. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: fix run-test.shPablo Neira Ayuso2015-08-261-2/+2
| | | | | | | | | | This reports: run-test.sh: line 3: UID: read-only variable rename it to _UID. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: don't link against libnetfilter_conntrackArturo Borrero2015-08-261-1/+0
| | | | | | | | | | | | The nfct program uses none of the symbols of libnetfilter_conntrack. Linking against it means that distributors have to maintain an useless depedency. This was spotted by the dpkg-shlibdeps tool. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc/debian.conntrackd.init.d: drop fileArturo Borrero Gonzalez2015-08-261-48/+0
| | | | | | | | | | This file is likely dead code. It's outdated. Also I think distributors should manage themselves to integrate daemons in their operating systems. Following this idea, this file doesn't belong here. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* list: fix prefetch dummyArturo Borrero Gonzalez2015-08-261-1/+1
| | | | | | | | | | | | | | | | | [...] CC conntrack.o In file included from ../include/conntrack.h:4:0, from conntrack.c:41: conntrack.c: In function ‘findproto’: ../include/linux_list.h:385:59: warning: right-hand operand of comma expression has no effect [-Wunused-value] for (pos = list_entry((head)->next, typeof(*pos), member), \ ^ [...] The original patch is from Patrick McHardy <kaber@trash.net>. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: missing break in expectation message parser functionPablo Neira Ayuso2015-08-181-1/+3
| | | | | | | Fortunately, the TLVs come in order in the message, however, if the order is changed we'll incorrectly set up the expectation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: use strncpy to set up the cache namePablo Neira Ayuso2015-08-181-2/+3
| | | | | | | This is not exposed, but use the strncpy() variant to calm down static code validators. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: simplify branch in tcp_accept()Pablo Neira Ayuso2015-08-181-7/+5
| | | | | | The same code is executed regardless the reason why accept() has failed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix error handling in nfq_queue_cb()Pablo Neira Ayuso2015-08-182-15/+16
| | | | | | | Make sure we have a clean exit on error, everything needs to be properly released. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix descriptor leak in do_local_request()Pablo Neira Ayuso2015-08-181-2/+5
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix leak in fork_process_new()Pablo Neira Ayuso2015-08-181-0/+2
| | | | | | Release the child_process structure in case that fork() fails. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: NTA_MAX is also an invalid attributePablo Neira Ayuso2015-08-181-1/+1
| | | | | | Otherwise this can result in an off-by-one array access. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix sanitization of expection attribute in the wire formatPablo Neira Ayuso2015-08-181-1/+1
| | | | | | The maximum number of attribute is NTA_EXP_MAX for expectation sync messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: made the protocol option value case insensitiveSzilárd Pfeiffer2015-07-031-1/+1
| | | | | | | | | Extensions register protocols by lowercase protocol name, but value of proto command line option may be uppercase. Extension related options cannot be used when protocol name comparision fails. Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix expectation entry creationSzilárd Pfeiffer2015-06-261-0/+2
| | | | | Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: refactor handling of address optionsSzilárd Pfeiffer2015-06-261-37/+32
| | | | | Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: conntrack: don't overwrite read-only shell variablePablo Neira Ayuso2015-06-261-1/+0
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cthelper: Optimise nfq_queue_cbPaul Aitken2015-06-121-5/+3
| | | | | | | | ct and myct have both already been checked for non-NULL, so there's no need to check either of them again later. Signed-off-by: Paul Aitken <paitken@brocade.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: remove unused 'numbytes'Paul Aitken2015-06-121-2/+1
| | | | | | | 'numbytes' isn't used and can be removed. Signed-off-by: Paul Aitken <paitken@brocade.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: Fix wrong memset usagePablo Neira Ayuso2015-05-291-17/+6
| | | | | | | | memset fills bytes, not ulongs - so the second parameter (the fill value) has to be a byte. Reported-by: Paul Aitken <paitken@brocade.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cthelper: don't pass up a 0 length queueChas Williams III2015-05-211-1/+4
| | | | | | | | | If the user didn't specify a queue length in the configuration file it will have a length of 0. Allow the kernel's default to take precedence instead. Signed-off-by: Charles (Chas) Williams <ciwillia@brocade.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Use <fcntl.h> instead of legacy synonym <sys/fcntl.h>Felix Janda2015-05-211-1/+1
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Define _GNU_SOURCE to get members of tcphdr&ucphdrFelix Janda2015-05-214-0/+4
| | | | | | | | | The source uses linux names for members of tcphdr. For example "source" instead of "th_sport", ... musl libc's headers need _GNU_SOURCE defined in order to expose these. Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Include <sys/select.h> for fd_setFelix Janda2015-05-213-0/+3
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Use stdint typesFelix Janda2015-05-2116-28/+28
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Sync with kernel headersFelix Janda2015-05-212-42/+17
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure: Add AM_PROG_AR to silence automake warningFelix Janda2015-05-211-0/+1
| | | | | | | | | /usr/share/automake-1.13/am/ltlibrary.am: warning: 'ct_helper_tns.la': linking libtool libraries using a non-POSIX /usr/share/automake-1.13/am/ltlibrary.am: archiver requires 'AM_PROG_AR' in 'configure.ac' src/helpers/Makefile.am:3: while processing Libtool library 'ct_helper_tns.la' Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: allow strings with underscore from flex scannerPablo Neira Ayuso2015-02-191-1/+1
| | | | | | | | | Some people use interface names with underscores, so allow them from the flex scanner. Original patch from http://patchwork.ozlabs.org/patch/440600/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix setting labels in updatesJarno Rajahalme2015-02-131-5/+19
| | | | | | | | | | | | | | | | | | When updating labels we always have to send the same sized bitmask as we received, as the bits we do omit will otherwise cleared as "padding". Mask has to have the same size as the labels, otherwise it will not be encoded by libnetfilter_conntrack, as different sizes are not accepted by the kernel either. Finally, kernel only retains old bit values that we send as zeroes in BOTH the label and the mask, due to XOR used in bit manipulation. This patch fixes all these issues and allows updates to set new labels without accidentally clearing old ones. Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix doc/cli/test.sh create-expectPablo Neira Ayuso2015-02-115-5/+5
| | | | | | | | | | | | | | | | | | when I run the test script of conntrack-tools sh doc/cli/test.sh create-expect the output is: conntrack v1.4.1 (conntrack-tools): You need to supply the `--reply-port-src' option for this command. Try `conntrack -h' or 'conntrack --help' for more information. This used to work without the --reply-port-src stuff using version 0.9.13 IIRC. Reported-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* channel: Fix file descriptor leak in channel_open() on errorThomas Jarosch2014-12-111-0/+1
| | | | | | | Detected by cppcheck Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* man: fix hyphen used as minus signArturo Borrero2014-09-252-13/+13
| | | | | | | | | | | | | | Report from Debian's lintian: This manual page seems to contain a hyphen where a minus sign was intended. By default, "-" chars are interpreted as hyphens (U+2010) by groff, not as minus signs (U+002D). Since options to programs use minus signs (U+002D), this means for example in UTF-8 locales that you cannot cut and paste options, nor search for them easily. [...] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: build: fix crash when optional kernel modules are not loadedPablo Neira Ayuso2014-06-131-9/+13
| | | | | | | | | Fix a possible crash if conntrackd sees DCCP, SCTP and ICMPv6 traffic and the corresponding kernel modules that track this traffic are not available. Fixes: http://bugzilla.netfilter.org/show_bug.cgi?id=910 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* udp: bind UDP sender side to same interface of the receiver sidePablo Neira Ayuso2014-05-291-2/+6
| | | | | | | | | Otherwise, the kernel may select a different interface for the client side. Original patch from Michael Griego. While at it, remove some trailing whitespaces. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: timeout: add support for default protocol timeout tuningPablo Neira Ayuso2014-05-133-2/+108
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new interface supersedes the /proc interface: /proc/sys/net/netfilter/nf_conntrack_PROTO_STATE_timeout to tune default conntrack timeout helpers. # nfct timeout default-get inet tcp .l3proto = 2, .l4proto = 6, .policy = { .SYN_SENT = 120, .SYN_RECV = 60, .ESTABLISHED = 432000, .FIN_WAIT = 120, .CLOSE_WAIT = 60, .LAST_ACK = 30, .TIME_WAIT = 120, .CLOSE = 10, .SYN_SENT2 = 120, .RETRANS = 300, .UNACKNOWLEDGED = 300, }, }; # nfct timeout default-set inet tcp ESTABLISHED 100 As replacement for the existing /proc interfaces for timeout tweaking. This feature requires a Linux kernel >= 3.13. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: remove unneeded included headerPablo Neira Ayuso2014-05-121-2/+0
| | | | | | | | This fixes a compilation breakage when libnetfilter_cttimeout.h is not installed. Reported-by: Hangbin Liu <liuhangbin@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: userspace SSDP helperAsh Hughes2014-03-124-1/+149
| | | | | | | | | | | | | Here is a patch which adds a userspace conntrack helper for the SSDP protocol. This is based on the code found at: http://marc.info/?t=132945775100001&r=1&w=2 I'm not sure how to get my laptop to play at IPv6, so I've not tested this part, but I've tested the IPv4 section and it works. Signed-off-by: Ash Hughes <ashley.hughes@blueyonder.co.uk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: don't include leftover .orig and .rej files in doc/Pablo Neira Ayuso2013-12-241-1/+2
| | | | | | | | And remove reference to .svn, we have been using git for quite some time already. Reported-by: Göran Uddeborg <goeran@uddeborg.se> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: Don't hardcode libs dir pathHani Benhabiles2013-10-151-2/+1
| | | | | | | Use CONNTRACKD_LIB_DIR instead of hardcoded path. Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: Fix use-after-free / double-freeHani Benhabiles2013-10-111-4/+0
| | | | | | | | | | | | helper's list and flush commands handlers shouldn't call mnl_socket_close on the passed netlink socket as it is done in the main function after parse_params call. Bug introduced in (3c78a45 nfct: src: consolidate netlink socket creation). Signed-off-by: Hani Benhabiles <kroosec@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: add amanda helperPablo Neira Ayuso2013-10-072-1/+209
| | | | | | | This patch adds a userspace port of the amanda helper that is currently implemented in the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
* conntrackd: cthelper: add TFTP helperPablo Neira Ayuso2013-10-034-0/+170
| | | | | | | | This patch adds an userspace port of the TFTP helper that is currently implemented in the kernel. This includes NAT support. It requires a Linux kernel 3.12. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: add SANE helperPablo Neira Ayuso2013-10-032-1/+178
| | | | | This patch adds an userspace port of the SANE helper that is currently implemented in the kernel. This requires Linux kernel 3.12 to work.
* nfct: src: consolidate netlink socket creationPablo Neira Ayuso2013-10-014-188/+68
| | | | | | | Open the socket from the main function, then pass it as parameter to the corresponding interpreter. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: src: add nfct_mnl_talk and use itPablo Neira Ayuso2013-10-014-158/+53
| | | | | | Add helper function nfct_mnl_talk and use it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>