summaryrefslogtreecommitdiffstats
path: root/src/conntrack.c
Commit message (Collapse)AuthorAgeFilesLines
...
* conntrack: add -o ktimestamp option (it requires linux >= 2.6.38)Pablo Neira Ayuso2011-02-171-2/+7
| | | | | | | | | | | | | | | | | | | | | | | This option requires Linux kernel >= 2.6.38, you have to enable conntrack timestamping with: echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp # conntrack -L -o ktimestamp udp 17 59 src=192.168.1.128 dst=192.168.1.1 sport=52050 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=52050 [ASSURED] mark=0 delta-time=121 [start=Thu Feb 17 17:41:18 2011] use=1 # conntrack -L conntrack v0.9.15 (conntrack-tools): 20 flow entries have been shown. udp 17 31 src=192.168.1.128 dst=192.168.1.1 sport=52050 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=52050 [ASSURED] mark=0 delta-time=149 use=1 # conntrack -E -o ktimestamp ... [DESTROY] udp 17 src=192.168.1.128 dst=192.168.1.1 sport=40162 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=40162 [ASSURED] delta-time=3 [start=Thu Feb 17 17:44:57 2011] [stop=Thu Feb 17 17:45:00 2011] # conntrack -E [DESTROY] udp 17 src=192.168.1.128 dst=77.226.252.14 sport=123 dport=123 src=77.226.252.14 dst=192.168.1.128 sport=123 dport=123 delta-time=8 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: allow to listen to all kind of expectation eventsPablo Neira Ayuso2010-10-121-8/+55
| | | | | | | So far, conntrack only allows to listen to events of new expectations. With this patch, we can listen to events of destroyed expectations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add zone supportPablo Neira Ayuso2010-07-051-22/+37
| | | | | | | | This patch adds `--zone' to the command line tool. This adds the missing user-space support for Patrick's McHardy iptables CT target. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: cleanup parsing of the NAT argumentsPablo Neira Ayuso2010-07-011-12/+19
| | | | | | | | | | | | | | | This patch cleans up nat_parse() and it also displays nicer error message for malformed arguments. % conntrack -L --src-nat :80 conntrack v0.9.14 (conntrack-tools): No IP specified Try `conntrack -h' or 'conntrack --help' for more information. % conntrack -L --src-nat 1.1.1.1: conntrack v0.9.14 (conntrack-tools): No port specified after `:' Try `conntrack -h' or 'conntrack --help' for more information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix `conntrack --[src|dst|any]-nat IP:PORT' if port mismatchesPablo Neira Ayuso2010-07-011-0/+16
| | | | | | | | This patch fixes the filtering if the IP matches an entry but the PORT does not matches. Without this patch, the entry is shown when it should be not. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: --[src|dst|any]-nat requires IP:PORT as argumentPablo Neira Ayuso2010-07-011-1/+3
| | | | | | | This patch restricts the behaviour that we previously introduced in 142606c60808b3ab0496155ac3d086765e6baef3. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix `conntrack --any-nat 1.1.1.1' filteringPablo Neira Ayuso2010-07-011-2/+2
| | | | | | | This patch adds the missing bits to allow to filter with --any-nat based on the IP address. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix `conntrack --src-nat 1.1.1.1' if PAT appliedPablo Neira Ayuso2010-07-011-6/+6
| | | | | | | | This patch fixes another scenario in which the flow has some PAT mangling and we passed the src-nat address that we want to use to perform the filtering. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix `conntrack --src-nat 3.3.3.3' and similarPablo Neira Ayuso2010-07-011-4/+14
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix bogus NATted flows in filteringPablo Neira Ayuso2010-07-011-4/+8
| | | | | | | | | | | With this patch, conntrack does not show bogus entries that have no NAT applied due to a relaxed checking. conntrack -L --src-nat :80 tcp 6 342824 ESTABLISHED src=XX.214.188.80 dst=66.XX.7.180 sport=80 dport=13749 packets=4 bytes=6000 [UNREPLIED] src=66.XX.7.180 dst=XX.214.188.80 sport=13749 dport=80 packets=0 bytes=0 mark=0 secmark=0 use=1 conntrack v0.9.14 (conntrack-tools): 1 flow entries have been shown. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: re-fix inconsistent display with `--src-nat' and `--dst-nat'Pablo Neira Ayuso2010-07-011-46/+30
| | | | | | | | | | In 142606c60808b3ab0496155ac3d086765e6baef3, I re-introduced the inconsistent behaviour that I described in 85f94171a71880c744f265268f33ad58819caa74. Great. This patch fixes this again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add `--any-nat' to filter any NATted flowPablo Neira Ayuso2010-07-011-22/+70
| | | | | | | This patch adds the --any-nat option that allows to display src-NATted OR dst-NATted flows. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix port filter with `--src-nat' and `--dst-nat'Pablo Neira Ayuso2010-06-281-31/+39
| | | | | | | | This patch allows the following command to filter port-based NAT: $ conntrack -L --dst-nat :9999 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: put all the commands and options code togetherPablo Neira Ayuso2010-06-221-120/+263
| | | | | | | | This patch is a cleanup, it puts all the commands and options code together. This makes easier and less error-prone the task to add new commands and options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: expand array that maps option-flags to option-namesPablo Neira Ayuso2010-06-221-3/+23
| | | | | | | This patch is a cleanup, it expands an array that contains the correspondence between the option-flags and the option-names. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: `-L --src-nat --dst-nat' filter using AND, not OR logicPablo Neira Ayuso2010-06-171-3/+17
| | | | | | | | | | | | The patch that I committed in 2e06d62d341fdf936dbc1fa944d5e03f761aaf0e was incomplete. With it, `-L --src-nat --dst-nat' shows source-natted OR destination-natted flows. This patch changes the behaviour to show source-natted AND destination-natted flows. This is the consistent behaviour that we expect from conntrack (this is how it works for other options indeed). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix `conntrack -L --src-nat --dst-nat' (second try)Pablo Neira Ayuso2010-06-171-13/+9
| | | | | | This patch fixes the filtering with --src-nat and --dst-nat options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: revert fix `-L --src-nat --dst-nat'Pablo Neira Ayuso2010-06-171-9/+13
| | | | | | | This patch reverts 0865d22af0ec5876f721d44c90ac898fdfa435aa since it breaks conntrack listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix `-L --src-nat --dst-nat'Pablo Neira Ayuso2010-06-101-13/+9
| | | | | | | | Since > 0.9.6, the conntrack listing with the options --src-nat and --dst-nat does not work. This patch fixes the problem. Reported-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use fscanf() instead of read() for showing counterHannes Eder2009-10-081-7/+6
| | | | | | | | | | Read an integer right away with fscanf() instead of read()-ing to a buffer, which was actually to small for the terminating '\0', and atoi()-ing. Furthermore read() might not read enough, though unlikely here. Signed-off-by: Hannes Eder <heder@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: avoid error with expectations when using 'conntrack -E -e ALL ...'Hannes Eder2009-10-081-1/+2
| | | | | | | | | | | | | | | Avoid this error: conntrack v0.9.13 (conntrack-tools): Operation failed: No such file or directory when using 'conntrack -E -e ALL ...'. This is caused by the fact that netfilter expectations also get delivered, but things are not setup for this, nfnl_catch returns -1 and errno = ENOENT. Signed-off-by: Hannes Eder <heder@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix output when no arguments are passedHannes Eder2009-10-071-1/+1
| | | | | | | | When 'conntrack' is called with no arguments then garbage is printed after the usage message. This patch fixes this. Signed-off-by: Hannes Eder <heder@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add GRE supportPablo Neira Ayuso2009-04-181-0/+1
| | | | | | | This patch adds GRE support for the command line tool conntrack. With this patch, we support all protocols available in the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.
* conntrack: fix English typo in output messagePablo Neira Ayuso2009-04-141-9/+9
| | | | | | This patch fixes an English typo in an output message. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add DCCP supportPablo Neira Ayuso2009-04-111-0/+1
| | | | | | This patch adds DCCP support for the command line tool conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add SCTP supportPablo Neira Ayuso2009-04-111-0/+1
| | | | | | This patch adds SCTP support to the command line tool conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add UDPlite supportPablo Neira Ayuso2009-04-111-0/+1
| | | | | | This patch adds UDPlite support for the command line tool conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix coupled-options sanity checkingsPablo Neira Ayuso2009-04-111-18/+59
| | | | | | | | | | | | This patch extends the generic_opt_check() function to add extra information on the possible option combinations. Under some specific situations, like the creation and getting of a conntrack, you may specify the original or the reply tuple but at least one MUST be present. This handling has been always tricky, it still remains but we're more user friendly at least. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: remove broken command checking codePablo Neira Ayuso2009-03-311-22/+6
| | | | | | | | | This patch removes the broken command checking. This is better handled by the option checkings which comes just after this one. This patch also fixes some inconsistencies in the command parameter checking when long names are used. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add `-S' command to display kernel statisticsPablo Neira Ayuso2009-03-311-4/+83
| | | | | | | | | This patch adds `-S' command to display kernel statistics. Using raw `cat' on /proc and the hexadecimal output is not very handy. This option parses the /proc entry and display the information is a more human friendly way. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix missing bits in `-C' commandPablo Neira Ayuso2009-03-311-1/+4
| | | | | | | | This patch fixes some missing bits for the `-C' conntrack command like the manpage information, the usage help, the `--counters' synonymous and the commands vs. options checking. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix use of -u which is optional with -IPablo Neira Ayuso2009-01-211-1/+1
| | | | | | | | | | The option --status can be used with -I. Currently, this behaviour is broken. conntrack v0.9.9 (conntrack-tools): Illegal option `--status' with this command Try `conntrack -h' or 'conntrack --help' for more information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add -C command to display the counterPablo Neira Ayuso2009-01-171-5/+45
| | | | | | | | | | This patch adds the -C command, to display the table counter. In the case of `-C conntrack' the tool reads the proc interface. For expectation, it loops on the table to count the number of entries (as there is not proc interface to display the number of expectations). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add new --status EXPECTED to filter expected connectionsPablo Neira Ayuso2008-12-041-2/+2
| | | | | | | | With this patch, you can filter expected connections: # conntrack -L --status EXPECTED Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: move release options code to free_options()Pablo Neira Ayuso2008-11-281-12/+11
| | | | | | | | This patch move the options release to free_options(). It also move the free_options call after the error checking because exit_error already free the option. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: support diminutives for -LPablo Neira Ayuso2008-11-281-2/+2
| | | | | | | | | | | | | | | | With this patch, you can specify the following command to dump the expectation table, instead of writing 'expect'. # conntrack -L e also, it is valid the following command: # conntrack -L ex # conntrack -L exp and so on. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: remove hardcoded buffer size, use sizeof insteadPablo Neira Ayuso2008-11-281-3/+3
| | | | | | | This patch replaces a couple of hardcoded buffer sizes by sizeof() calls. This sort of code is error-prone. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: do_parse_parameter show warning to stderr (not to stdout)Pablo Neira Ayuso2008-11-281-2/+4
| | | | | | | This patch fixes a wrong warning display to stdout instead of stderr. Make the warning message homogeneous to others. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: --status should not be mandatory with -IPablo Neira Ayuso2008-11-151-1/+1
| | | | | | | | | This patch relaxes the parameter checking as now we don't need to pass --status when we create a conntrack via command line interface. In this case, the conntrack entry is created only with the IPS_CONFIRMED flag. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: cleanup for NAT filteringPablo Neira Ayuso2008-10-161-24/+9
| | | | | | | | | | This patch cleanups the NAT filtering. The former code had three branches, one if src and dst NAT are set, else one if src NAT is set, else one if dst NAT is set. Now, we check if src NAT is set or if dst NAT is set. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix dump counter displayed with -L expectPablo Neira Ayuso2008-10-091-0/+1
| | | | | | This patch fixes the dump counter displayed with -L expect. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix filtering for unsupported protocolPablo Neira Ayuso2008-10-041-16/+50
| | | | | | | | | This patch fixes filtering for unsupported protocol. Thus, you can use -L -p 47 or -L -p gre to filter `gre' traffic. Based on an initial patch from Bryan Duff <bduff@astrocorp.com>. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix mark-based filtering for event displayPablo Neira Ayuso2008-10-021-3/+6
| | | | | | | | | | | The mark-based filtering for events does not work if the mark is not present in the event message. This happens because nfct_cmp() skips the comparison of the compared objects since it they do not have the same attributes set. This patch make use of the new NFCT_CMP_MASK flag that returns false if the first object passed as parameter is set and the second is not. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: cleanup XML header handlingPablo Neira Ayuso2008-09-281-22/+6
| | | | | | | This patch removes the use of snprintf and directly print the XML header to the standard output. This simplifies the handling. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: cleanup for the update pathPablo Neira Ayuso2008-09-281-4/+5
| | | | | | This patch cleans up the update path for the conntrack utility. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: insert `conntrack-tools' string in help and error messagesPablo Neira Ayuso2008-08-121-4/+4
| | | | | | | Insert string `conntrack-tools' in error messages to explicitly print that this version is inside the conntrack-tools package. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: check for missing arguments in getopt_longPablo Neira Ayuso2008-08-121-7/+13
| | | | | | | | | From: Pablo Neira Ayuso <pablo@netfilter.org> If getopt_long returns '?', show an error telling that some arguments are missing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: remove unrequired \n in error messagePablo Neira Ayuso2008-08-121-1/+1
| | | | | | Remove extra \n in error message. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: remove duplicated optarg checkingPablo Neira Ayuso2008-08-121-36/+0
| | | | | | | Remove duplicated optarg checkings for options that require mandatory paramaters. This checking is already done by getopt_long(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fix: use %zu instead of %u for size_tPablo Neira Ayuso2008-08-011-1/+1
| | | | | | Use %zu instead of %u for size_t to remove compilation warning. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>