summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* helpers: Fix for warning when compiling against libtirpcHEADmasterPhil Sutter2019-11-121-3/+4
| | | | | | | | | | | | | | | | | Fix for the following warning: In file included from rpc.c:29: /usr/include/tirpc/rpc/rpc_msg.h:214:52: warning: 'struct rpc_err' declared inside parameter list will not be visible outside of this definition or declaration 214 | extern void _seterr_reply(struct rpc_msg *, struct rpc_err *); | ^~~~~~~ Struct rpc_err is declared in rpc/clnt.h which also declares rpc_call(), therefore rename the local version. Fixes: 5ededc4476f27 ("conntrackd: search for RPC headers") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Makefile.am: Use ${} instead of @...@Phil Sutter2019-11-123-4/+4
| | | | | | | | | | Referencing to variables using @...@ means they will be replaced by configure. This is not needed and may cause problems later. Suggested-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: UDP IPv6 destination address not usable (Bug 1378)Jan-Martin Raemer2019-11-071-1/+1
| | | | | | | | | | | As reported in https://bugzilla.netfilter.org/show_bug.cgi?id=1378, conntrackd refuses to start with a valid IPv6_Destination_Address, reporting "inet_pton(): IPv6 unsupported" due to a forgotten handling of err > 0 (i.e. success). This patch fixes the issue. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1378 Signed-off-by: Jan-Martin Raemer <raemer@zit-rlp.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* docs: refresh references to /proc/net/core/rmem_defaultArturo Borrero Gonzalez2019-10-304-4/+4
| | | | | | | | | | | In recent kernel versions, /proc/net/core/rmem_default is now /proc/sys/net/core/rmem_default instead. Refresh docs that mention this file. Reported-by: Raphaël Bazaud <rbazaud@gmail.com> Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: incorrect filtering of Address with cidr /0Pablo Neira Ayuso2019-09-301-3/+9
| | | | | | Set an all zero mask when cidr /0 is specified. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: Fix "Address Accept" filter caseRobin Geuze2019-09-301-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes a bug in the Address Accept filter case where if you only specify either addresses or masks it would never match, eg. Filter From Usespace { Address Accept { IPv4_address 127.0.0.1 } } or Filter From Usespace { Address Accept { IPv4_address 0.0.0.0/0 } } If lpm filter fails, fall back to hashtable lookup for exact matching. If lpm filter succeeds, then depending on the policy, skip hashtable lookup (in case policy is accept) or return mismatch (in case policy is ignore). Signed-off-by: Robin Geuze <robing@transip.nl> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: helper: Fix NFCTH_ATTR_PROTO_L4NUM sizePhil Sutter2019-09-101-1/+1
| | | | | | | | | | | | Kernel defines NFCTH_TUPLE_L4PROTONUM as of type NLA_U8. When adding a helper, NFCTH_ATTR_PROTO_L4NUM attribute is correctly set using nfct_helper_attr_set_u8(), though when deleting nfct_helper_attr_set_u32() was incorrectly used. Due to alignment, this causes trouble only on Big Endian. Fixes: 5e8f64f46cb1d ("conntrackd: add cthelper infrastructure (+ example FTP helper)") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Fix CIDR to mask conversion on Big EndianPhil Sutter2019-09-041-1/+1
| | | | | | | | | | Code assumed host architecture to be Little Endian. Instead produce a proper mask by pushing the set bits into most significant position and apply htonl() on the result. Fixes: 3f6a2e90936bb ("conntrack: add support for CIDR notation") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix strncpy -Wstringop-truncation warningsJose M. Guisado Gomez2019-08-175-20/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -Wstringop-truncation warning was introduced in GCC-8 as truncation checker for strncpy and strncat. Systems using gcc version >= 8 would receive the following warnings: read_config_yy.c: In function ‘yyparse’: read_config_yy.y:1594:2: warning: ‘strncpy’ specified bound 16 equals destination size [-Wstringop-truncation] 1594 | strncpy(policy->name, $2, CTD_HELPER_NAME_LEN); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ read_config_yy.y:1384:2: warning: ‘strncpy’ specified bound 256 equals destination size [-Wstringop-truncation] 1384 | strncpy(conf.stats.logfile, $2, FILENAME_MAXLEN); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ read_config_yy.y:692:2: warning: ‘strncpy’ specified bound 108 equals destination size [-Wstringop-truncation] 692 | strncpy(conf.local.path, $2, UNIX_PATH_MAX); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ read_config_yy.y:169:2: warning: ‘strncpy’ specified bound 256 equals destination size [-Wstringop-truncation] 169 | strncpy(conf.lockfile, $2, FILENAME_MAXLEN); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ read_config_yy.y:119:2: warning: ‘strncpy’ specified bound 256 equals destination size [-Wstringop-truncation] 119 | strncpy(conf.logfile, $2, FILENAME_MAXLEN); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ main.c: In function ‘main’: main.c:168:5: warning: ‘strncpy’ specified bound 4096 equals destination size [-Wstringop-truncation] 168 | strncpy(config_file, argv[i], PATH_MAX); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix the issue by checking for string length first. Also using snprintf instead. In addition, correct an off-by-one when warning about maximum config file path length. Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: support for IPS_OFFLOADPablo Neira Ayuso2019-08-094-10/+32
| | | | | | | | # conntrack -L -u OFFLOAD tcp 6 431984 ESTABLISHED src=192.168.10.2 dst=10.0.1.2 sport=32824 dport=5201 src=10.0.1.2 dst=10.0.1.1 sport=5201 dport=32824 [OFFLOAD] mark=0 secctx=null use=2 tcp 6 431984 ESTABLISHED src=192.168.10.2 dst=10.0.1.2 sport=32826 dport=5201 src=10.0.1.2 dst=10.0.1.1 sport=5201 dport=32826 [OFFLOAD] mark=0 secctx=null use=2 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: Add new SLP helperMichal Kubecek2019-07-223-0/+100
| | | | | | | | | | | | | | | | | | | Service Location Protocol (SLP) uses multicast requests for DA (Directory agent) and SA (Service agent) discovery. Replies to these requests are unicast and their source address does not match destination address of the request so that we need a conntrack helper. A kernel helper was submitted back in 2013 but was rejected as userspace helper infrastructure is preferred. This adds an SLP helper to conntrackd. As the function of SLP helper is the same as what existing mDNS helper does, src/helpers/slp.c is essentially just a copy of src/helpers/mdns.c, except for the default timeout and example usage. As with mDNS helper, there is no NAT support for the time being as that would probably require kernel side changes and certainly further study (and could possibly work only for source NAT). Signed-off-by: Michal Kubecek <mkubecek@suse.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: use correct max unix path lengthMichal Kubecek2019-07-151-1/+6
| | | | | | | | | | | When copying value of "Path" option for unix socket, target buffer size is UNIX_MAX_PATH so that we must not copy more bytes than that. Also make sure that the path is null terminated and bail out if user provided path is too long rather than silently truncate it. Fixes: ce06fb606906 ("conntrackd: use strncpy() to unix path") Signed-off-by: Michal Kubecek <mkubecek@suse.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: Use strdup in lexerAsh Hughes2019-07-032-4/+66
| | | | | | | | | Use strdup in the config file lexer to copy strings to yylval.string. This should solve the "[ERROR] unknown layer 3 protocol" problem here: https://www.spinics.net/lists/netfilter/msg58628.html. Signed-off-by: Ash Hughes <sehguh.hsa@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: search for RPC headersAsh Hughes2019-05-302-1/+3
| | | | | | | | Attempts to get RPC headers from libtirpc if they aren't otherwise available. Signed-off-by: Ash Hughes <sehguh.hsa@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-notrack: Apply userspace filter on resync with internal cache disabledRobin Geuze2019-05-301-0/+3
| | | | | | | | | Always apply the userspace filter when doing a direct sync from the kernel when internal cache is disabled, since a dump does not apply a kernelspace filter. Signed-off-by: Robin Geuze <robing@transip.nl> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-mode: Also cancel flush timer in ALL_FLUSH_CACHESimon Kirby2019-05-121-0/+2
| | | | | | | | | This makes the behaviour of "conntrackd -f" match that of "conntrackd -f internal" with resepect to stopping a timer ("conntrackd -t") from possibly flushing again in the future. Signed-off-by: Simon Kirby <sim@hostway.ca> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Allow protocol number zeroBrian Haley2019-03-201-1/+1
| | | | | | | | | | | /etc/protocols defines protocol zero as 'ip' for IPv4, and 'hopopt' for IPv6, which can be used with conntrack as '-p ip' or '-p hopopt'. However it's equivalent, '-p 0' is considered unsupported. Change the range check in findproto() to allow zero as well. Signed-off-by: Brian Haley <bhaley@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: use strncpy() to unix pathPablo Neira Ayuso2019-03-201-1/+2
| | | | | | | Make sure we don't go over the buffer boundary. Reported-by: Rijnard van Tonder <rvt@cmu.edu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add -o userspace option to tag user-triggered eventsPablo Neira Ayuso2019-02-202-6/+16
| | | | | | | | | | | | | | The following command: # conntrack -E -o userspace & # conntrack -F [DESTROY] tcp 6 src=122.127.186.172 dst=192.168.10.195 sport=443 dport=48232 packets=56 bytes=5313 src=192.168.10.195 dst=122.127.186.172 sport=48232 dport=443 packets=49 bytes=5174 [ASSURED] [USERSPACE] prints the [USERSPACE] tag at the end of the event, this tells users if this event has been triggered by process, eg. via conntrack command invocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use libmnl for conntrack eventsPablo Neira Ayuso2019-02-201-37/+83
| | | | | | Use libmnl instead libnfnetlink infrastructure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: extend nfct_mnl_socket_open() to use it to handle eventsPablo Neira Ayuso2019-02-201-8/+8
| | | | | | Add parameter to nfct_mnl_socket_open() to subscribe to events. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix for implicit-fallthrough warningsPhil Sutter2019-02-134-1/+5
| | | | | | | | Mark fall through cases as such. Note that correctness of those fall throughs have not been verified. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfct: Drop dead code in nfct_timeout_parse_params()Phil Sutter2019-02-131-14/+0
| | | | | | | | | | | | Due to the first switch() in that function, default case in second one is unreachable. Given that both of them contain the same cases but the first one merely acts as an invalid command barrier (adding no value to the second one), drop the first one to make invalid commands actually hit default case in the second switch(). Fixes: dd73ceecdbe87 ("nfct: Update syntax to specify command before subsystem") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: helpers: dhcpv6: Fix potential array overrunPhil Sutter2019-02-121-1/+1
| | | | | | | | | | The value dhcpv6_msg_type points at is used as index to dhcpv6_timeouts array, so upper boundary check has to treat a value of ARRAY_SIZE(dhcpv6_timeouts) as invalid. Fixes: 36118bfc4901b ("conntrackd: helpers: add DHCPv6 helper") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd.conf.8: fix state filter exampleArturo Borrero Gonzalez2019-01-281-5/+5
| | | | | | | | | Missing 'for TCP' induces errors. This was reported in Debian bug #916138 https://bugs.debian.org/916138 Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use -Wno-sign-compare with autogenerated flex codePablo Neira Ayuso2018-05-091-1/+1
| | | | | | | | | | | | | CC read_config_lex.o read_config_lex.c: In function ‘yy_get_next_buffer’: read_config_lex.c:2101:18: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] for ( n = 0; n < max_size && \ ^ read_config_lex.c:3016:3: note: in expansion of macro ‘YY_INPUT’ YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]), ^~~~~~~~ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: -f family filter does not workRonald Wahl2018-05-091-6/+6
| | | | | | | | | | "conntrack -L -f ipv4" and "conntrack -L -f ipv6" each prints both protocols. This is because the family filtering is now enabled only if filter_mark_kernel_set is true. Fixes: 8b8377163697 ("conntrack: send mark filter to kernel iff set") Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack-tools 1.4.5 releaseconntrack-tools-1.4.5Arturo Borrero Gonzalez2018-05-011-2/+2
| | | | Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
* systemd: default to use libsystemd if build with support for itArturo Borrero Gonzalez2018-04-187-11/+13
| | | | | | | | | | | | | | We may assume that if an user does build conntrackd with such feature, is with the intention to use it. So, if that's the case, default to use it. This eases some downstream use cases when dealing with default configs to be shipped to final users. This could be a mid-point solution, given some users are asking for a full revert of commit c01d0d9138112ec95ee316385ea2687dd94fa4e3. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: reallocate cli testing scriptArturo Borrero Gonzalez2018-04-181-0/+0
| | | | | | | Move this to test/ Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: synproxy supportPablo Neira Ayuso2018-03-243-0/+37
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add TCP flags supportPablo Neira Ayuso2018-03-201-37/+19
| | | | | | | | | | | | | | Back in 2008, there was no TCP flags support in the kernel, hence the workaround was to infer the flags from the TCP state. This patch is implicitly fixing a problem, since the existing RETRANS and UNACK TCP conntrack states plus the _CLOSE_INIT flag that is bogusly infered (to be frank, it was correctly infered back in 2008, but after adding new TCP states, it was not). Let's just use the flags that we get via synchronization messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ARRAY_SIZE definitionPablo Neira Ayuso2018-03-202-2/+4
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd.conf.5: fix sentence about systemdArturo Borrero Gonzalez2018-01-251-2/+2
| | | | | | | Typos, duplicated systemd word in the sentence and 'obviously'. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack.8: refresh manpageArturo Borrero Gonzalez2017-09-271-66/+101
| | | | | | | | | | Refresh manpage, fixing typos, rearranging some sentences, introducing line breaks at max. 80 columns, markup fixes, and so on. Apart of some minor cosmetics fixes, no actual content is changed. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: don't fail on modprobe since the driver might be built-inSteve Langasek2017-08-242-12/+16
| | | | | | | | | | | | | | Any of these nf drivers could be built-ins instead of modules; don't cause the testsuite to fail on modprobe, instead let it proceed and succeed/fail later based on actual test results. Ideally we would check up front if the driver is loaded rather than trying to modprobe and ignoring failures, but there doesn't seem to be a reliable place to check this in the kernel filesystem. Signed-off-by: Steve Langasek <steve.langasek@ubuntu.com> Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cthelper: ssdp: fix build with muslStijn Tintel2017-08-241-0/+1
| | | | | | | | | For musl libc to expose the members of `struct tcphdr`, _GNU_SOURCE needs to be defined. Fixes: b61c4543cbde ("conntrackd: cthelper: ssdp: Track UPnP eventing") Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Show multiple CPUs stats from procChieh-Min Wang2017-08-241-16/+18
| | | | | | | | | When read cpu conntrack stats from /proc/net/stat/nf_conntrack, it only shows stats from cpu0. This patch list all cpus' conntrack stats like what `nfexp_stats_cb` did. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: remove warning for -SArturo Borrero Gonzalez2017-08-141-3/+0
| | | | | | | | | | Remove the warning message for the -S option which has been deprecated for years now. Users calling conntrackd with this switch activated will now get an error. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: make the daemon run in RT mode by defaultArturo Borrero Gonzalez2017-06-1210-156/+39
| | | | | | | | | | | | | | | | | | | | | | | In order to prevent netlink buffer overrun, conntrackd is recommended to run at max priority. Make conntrackd to use a RT (SHED_RR) scheduler by default at max priority. This is common among other HA daemons. For example corosync uses SCHED_RR by default. The scheduler configuration option is kept in order to allow admins to perform fine-tuning, but it is deleted from example configuration files. Note that this default sched priority is so high that it makes the nice value useless, so deprecate the nice configuration. Anyway the nice value can be set externally at runtime using nice/renice. The code is moved to the init() routine. In case of error setting the scheduler, the system default will be used. Report a message to the user and continue working. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: deprecate unix backlog configurationArturo Borrero Gonzalez2017-06-069-15/+5
| | | | | | | | | This configuration option doesn't add any value to users. Use the magic value of 100 (i.e, the socket will keep 100 pending connections), which I think is fair enough for what conntrackd can do in the unix socket. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: cleanup if failed forkingArturo Borrero Gonzalez2017-06-061-0/+2
| | | | | | | Close the logs and lockfile if error while forking. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: evaluate configuration earlierArturo Borrero Gonzalez2017-06-061-11/+9
| | | | | | | | Run the evaluation step sooner in the conntrackd startup routine. Don't close log or unlink lockfile at this stage. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: remove use of HAVE_INET_PTON_IPV6Nicolas Dichtel2017-06-063-71/+46
| | | | | | | | | | | | | | | | | The goal of this patch is to fix the ipv6 support when conntrackd is cross-compiled. The AC_RUN_IFELSE macro must be avoided as much as possible. See section 6.6 of the gnu autoconf: "If you really need to test for a runtime behavior while configuring, you can write a test program to determine the result, and compile and run it using AC_RUN_IFELSE. Avoid running test programs if possible, because this prevents people from configuring your package for cross-compiling." Let's remove this check and test the returned error to handle the case where ipv6 is not supported (inet_pton() returns -1 when the family is not supported). Reported-by: Zhenlin Zhang <zhenlin.zhang@6wind.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: request resync at startupArturo Borrero Gonzalez2017-05-157-5/+47
| | | | | | | | | If a node goes to live, ask the other for resync at startup. This has to be done usually by hand, but I guess is an operation common enough to add some bits to ease people life here. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: consolidate more code to use resync_send()Arturo Borrero Gonzalez2017-05-152-12/+8
| | | | | | | | | | | These digest_msg() functions can use resync_send() as well. While at it, bring back a call to kernel_resync() in notrack_local() which was lost in a previous commit. Fixes: 131df891f77dc75515d5eabdedd9818105d29f5a ("conntrackd: factorize resync operations") Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: factorize resync operationsArturo Borrero Gonzalez2017-05-086-20/+55
| | | | | | | | | | | Resync operations factorization. There are two: * resync_send --> conntrackd -B (send bulk resync) * resync_req --> conntrackd -n (request resync) Future patches reuse this factorized code. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: factorice tx_queue functionsArturo Borrero Gonzalez2017-05-086-74/+71
| | | | | | | They are shared by both sync-ftfw and sync-notrack. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Support IPv6 NATNeil Wilson2017-03-174-67/+216
| | | | | | | | | | Refactor and improve nat support to allow conntrack to manage IPv6 NAT entries. Refactor and improve conntrack nat tests to include IPv6 NAT. Signed-off-by: Neil Wilson <neil@aldur.co.uk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: CommitTimeout breaks DisableExternalCache set OnPablo Neira Ayuso2017-03-103-0/+25
| | | | | | | | | | | This patch introduces a new evaluate() function that can be used to spot inconsistent configurations. Don't allow CommitTimeout with DisableExternalCache On since this results in EINVAL errors. CommitTimeout makes no sense with no external cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.1 (git 2.18.0) at 2020-01-21 06:49:24 +0000