summaryrefslogtreecommitdiffstats
path: root/src/conntrack.c
Commit message (Collapse)AuthorAgeFilesLines
* conntrack: Allow protocol number zeroBrian Haley2019-03-201-1/+1
| | | | | | | | | | | /etc/protocols defines protocol zero as 'ip' for IPv4, and 'hopopt' for IPv6, which can be used with conntrack as '-p ip' or '-p hopopt'. However it's equivalent, '-p 0' is considered unsupported. Change the range check in findproto() to allow zero as well. Signed-off-by: Brian Haley <bhaley@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add -o userspace option to tag user-triggered eventsPablo Neira Ayuso2019-02-201-5/+14
| | | | | | | | | | | | | | The following command: # conntrack -E -o userspace & # conntrack -F [DESTROY] tcp 6 src=122.127.186.172 dst=192.168.10.195 sport=443 dport=48232 packets=56 bytes=5313 src=192.168.10.195 dst=122.127.186.172 sport=48232 dport=443 packets=49 bytes=5174 [ASSURED] [USERSPACE] prints the [USERSPACE] tag at the end of the event, this tells users if this event has been triggered by process, eg. via conntrack command invocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: use libmnl for conntrack eventsPablo Neira Ayuso2019-02-201-37/+83
| | | | | | Use libmnl instead libnfnetlink infrastructure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: extend nfct_mnl_socket_open() to use it to handle eventsPablo Neira Ayuso2019-02-201-8/+8
| | | | | | Add parameter to nfct_mnl_socket_open() to subscribe to events. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: -f family filter does not workRonald Wahl2018-05-091-6/+6
| | | | | | | | | | "conntrack -L -f ipv4" and "conntrack -L -f ipv6" each prints both protocols. This is because the family filtering is now enabled only if filter_mark_kernel_set is true. Fixes: 8b8377163697 ("conntrack: send mark filter to kernel iff set") Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Show multiple CPUs stats from procChieh-Min Wang2017-08-241-16/+18
| | | | | | | | | When read cpu conntrack stats from /proc/net/stat/nf_conntrack, it only shows stats from cpu0. This patch list all cpus' conntrack stats like what `nfexp_stats_cb` did. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: remove use of HAVE_INET_PTON_IPV6Nicolas Dichtel2017-06-061-2/+0
| | | | | | | | | | | | | | | | | The goal of this patch is to fix the ipv6 support when conntrackd is cross-compiled. The AC_RUN_IFELSE macro must be avoided as much as possible. See section 6.6 of the gnu autoconf: "If you really need to test for a runtime behavior while configuring, you can write a test program to determine the result, and compile and run it using AC_RUN_IFELSE. Avoid running test programs if possible, because this prevents people from configuring your package for cross-compiling." Let's remove this check and test the returned error to handle the case where ipv6 is not supported (inet_pton() returns -1 when the family is not supported). Reported-by: Zhenlin Zhang <zhenlin.zhang@6wind.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: Support IPv6 NATNeil Wilson2017-03-171-67/+146
| | | | | | | | | | Refactor and improve nat support to allow conntrack to manage IPv6 NAT entries. Refactor and improve conntrack nat tests to include IPv6 NAT. Signed-off-by: Neil Wilson <neil@aldur.co.uk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: send mark filter to kernel iff setPablo Neira Ayuso2016-12-231-10/+18
| | | | | | | | | Do not set a mark filter to ctnetlink if the user doesn't explicitly specify this. Fixes: aa925010951e ("conntrack: allow to filter by mark from kernel-space") Reported-by: Joseph Conley <joseph.j.conley@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: show --src and --dst options in usage output.Mart Frauenlob2016-04-081-2/+2
| | | | Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at>
* conntrack: Add missing tables dying and unconfirmed to usage output.Mart Frauenlob2016-04-071-1/+1
| | | | | Signed-off-by: Mart Frauenlob <mart.frauenlob@chello.at> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for CIDR notationAsbjørn Sloth Tønnesen2016-02-161-5/+81
| | | | | | | | | | | | | | Add support for using CIDR notation in --{orig,tuple}-{src,dst} arguments, instead of free-form formatting netmask in --mask-{src,dst}. Example: conntrack -L -s 2001:db8::/56 Instead of: conntrack -L -s 2001:db8:: --mask-src ffff:ffff:ffff:ff00:: Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: extend parse_addr() with CIDR supportAsbjørn Sloth Tønnesen2016-02-161-7/+28
| | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk>
* conntrack: split up nfct_set_addr_from_opt()Asbjørn Sloth Tønnesen2016-02-161-13/+20
| | | | | | | | | Prepare for CIDR support, by splitting nfct_set_addr_from_opt() into nfct_parse_addr_from_opt() for parsing and nfct_set_addr_opt() for storing. Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for netmask filteringAsbjørn Sloth Tønnesen2016-02-081-13/+145
| | | | | | | | This patch extends --mask-src and --mask-dst to also work with the conntrack table, with commands -L, -D, -E and -U. Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: cleanup: use switch statements for family checksAsbjørn Sloth Tønnesen2016-02-011-8/+16
| | | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: consolidate filteringAsbjørn Sloth Tønnesen2016-02-011-37/+20
| | | | | Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: support delete by labelAsbjørn Sloth Tønnesen2016-02-011-0/+3
| | | | | | | | | | | This option was already silently allowed by 991fc4ae, but didn't have any effect. This patch adds the check and documents it. Cc: Clemence Faure <clemence.faure@sophos.com> Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix expectation entry creationAsbjørn Sloth Tønnesen2016-01-191-2/+4
| | | | | | | | | | | | | Store tuple-src and tuple-dst in exptuple, as used by the EXP_CREATE case. Verified with doc/cli/test.sh Also reorder the cases, so the netmask case is last. Reported-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "conntrack: fix expectation entry creation"Asbjørn Sloth Tønnesen2016-01-191-2/+0
| | | | | | | | | | {} is mask-src and mask-dst, [] is tuple-src and tuple-dst mask-* should be stored in mask, tuple-* should be stored in exptuple. This reverts commit 3309fdb4413cb32f9b95e05064dc9dbb56550939 since it mixed up {} and []. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add zone direction supportDaniel Borkmann2015-09-291-24/+43
| | | | | | | | | | | | | | | | This patch adds support for zone directions. Since all options have the orig/reply as a prefix, I named it --orig-zone and --reply-zone to stay consistent with the rest of the cmdline options. As for the option chars, there was no unallocated reasonable combination, thus only long options are officially exposed in the help, similarly as in other cases. Test suite results, after patch: OK: 79 BAD: 0 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: made the protocol option value case insensitiveSzilárd Pfeiffer2015-07-031-1/+1
| | | | | | | | | Extensions register protocols by lowercase protocol name, but value of proto command line option may be uppercase. Extension related options cannot be used when protocol name comparision fails. Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix expectation entry creationSzilárd Pfeiffer2015-06-261-0/+2
| | | | | Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: refactor handling of address optionsSzilárd Pfeiffer2015-06-261-37/+32
| | | | | Signed-off-by: Szilárd Pfeiffer <pfeiffer.szilard@balabit.hu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix setting labels in updatesJarno Rajahalme2015-02-131-5/+19
| | | | | | | | | | | | | | | | | | When updating labels we always have to send the same sized bitmask as we received, as the bits we do omit will otherwise cleared as "padding". Mask has to have the same size as the labels, otherwise it will not be encoded by libnetfilter_conntrack, as different sizes are not accepted by the kernel either. Finally, kernel only retains old bit values that we send as zeroes in BOTH the label and the mask, due to XOR used in bit manipulation. This patch fixes all these issues and allows updates to set new labels without accidentally clearing old ones. Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: do not exit when update returns an errorFlorian Westphal2013-09-151-5/+3
| | | | | | | | | | If we fail to update an entry, just try to continue with the next one instead of exiting. Can happen f.e. when using "conntrack -U --add-label bla", but the conntrack entry in the kernel does not have the label extension set. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: support add/delete of conntrack labelsClemence Faure2013-09-151-24/+130
| | | | | | | | new options "--label-add" and "--label-delete" to alter connlabels assigned to a connection. Signed-off-by: Clemence Faure <clemence.faure@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: support multiple -l optionsFlorian Westphal2013-09-151-1/+28
| | | | | | | | Using -l foo -l bar caused the "foo" label to be lost. Merge multiple -l options so "-l foo,bar" and "-l foo -l bar" have same effect. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: minor cleanupFlorian Westphal2013-09-041-22/+19
| | | | | | | | | Rename get_table to generic "optional argument handling" helper, so it can be re-used in upcoming patch. While at it, avoid copy&paste of "labelmap" handling. Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix dump of IPv6 entries in the dying and unconfirmed listPablo Neira Ayuso2013-08-071-11/+12
| | | | | | Use selected the family, instead of inconditionally request for IPv4. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix reporting of unknown argumentsClemence Faure2013-07-241-9/+7
| | | | | | | | | | | | | | | short options were always reported as "unknown argument". getopt(3) says: if [it] finds an option character in argv that was not included in optstring, or if it detects a missing option argument, it returns '?' and sets the external variable optopt to the actual option character. If the first character [...] of optstring is a colon (':'), then getopt() returns ':' instead of '?' to indicate a missing option argument. Signed-off-by: Clemence Faure <clemence.faure@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix -L format outputFlorian Westphal2013-07-241-1/+1
| | | | | | | | | commit d343b8c (conntrack: add connlabel format attribute) erronously removed _UNKNOWN format, i.e. conntrack -L displayed [UPDATE] tcp 6 114 TIME_WAIT src=.. ^^^^^ Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: introduce -l option to filter by labelsClemence Faure2013-07-231-25/+131
| | | | | Signed-off-by: Clemence Faure <clemence.faure@sophos.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: add connlabel format attributeFlorian Westphal2013-07-051-4/+13
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* conntrack: fix timestamps when microseconds are less than 100000Pablo Neira Ayuso2013-05-151-1/+1
| | | | | | | | | | | | The fractional portion of timestamps reported by conntrack is printed as a left-justified integer instead of fixed-width and zero-padded. Closes netfilter's bugzilla 817: https://bugzilla.netfilter.org/show_bug.cgi?id=817 Reported-by: hoffman@stanford.edu Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support to dump the dying and unconfirmed list via ctnetlinkPablo Neira Ayuso2012-12-041-13/+95
| | | | | | | | | | | | | | | | | | | | | | This patch adds support for: conntrack -L dying conntrack -L unconfirmed To display the list of dying and unconfirmed conntracks. This provides some instrumentation in case that `conntrack -C` really deviates from what `conntrack -L | wc -l` says. Users like to check this to make sure things are going OK. Still, some conntrack objects may be still in the dying and the unconfirmed list. With this patch, we can also dump their content, before it was not possible. In normal cases both lists would be simply empty, or in the case of the dying list, you can observe that entries go slightly down in number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: -C uses ctnetlink instead of ↵Pablo Neira Ayuso2012-08-011-1/+70
| | | | | | /proc/sys/net/netfilter/nf_conntrack_count Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for stats dumping via ctnetlinkPablo Neira Ayuso2012-08-011-7/+213
| | | | | | | | | | | | | | | | | | | | | | | | Since Linux kernel >= 3.6.x, we can dump the conntrack statistics via ctnetlink instead of using the /proc interface: conntrack -S cpu=0 searched=9177 found=387086 new=250451 invalid=1 ignore=4 delete=254093 delete_list=5467 insert=1825 insert_failed=0 drop=0 early_drop=0 error=0 search_restart=0 cpu=1 searched=390 found=37493 new=1531 invalid=0 ignore=0 delete=345 delete_list=345 insert=1531 insert_failed=0 drop=0 early_drop=0 error=0 search_restart=0 cpu=2 searched=333 found=68061 new=1895 invalid=0 ignore=1 delete=607 delete_list=607 insert=1896 insert_failed=0 drop=0 early_drop=0 error=0 search_restart=0 cpu=3 searched=71 found=13364 new=1254 invalid=0 ignore=0 delete=75 delete_list=75 insert=1254 insert_failed=0 drop=0 early_drop=0 error=0 search_restart=0 conntrack -S exp cpu=0 expect_new=9177 expect_create=387284 expect_delete=251141 cpu=1 expect_new=390 expect_create=37496 expect_delete=1531 cpu=2 expect_new=333 expect_create=68117 expect_delete=1895 cpu=3 expect_new=71 expect_create=13366 expect_delete=1255 Note that the output is not backward-compatible, but we fail back to previous output in case that ctnetlink stats dumping is not available. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: flush stdout for each expectation event, tooFlorian Westphal2012-05-201-0/+1
| | | | | | | | | else, piping "conntrack -E expect" output will be buffered/delayed, which is not what users expect. Normal conntrack events are already flushed. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: allow to filter by mark from kernel-spacePablo Neira Ayuso2012-02-141-4/+37
| | | | | | | | | | | | This patch uses the new infrastructure that allows us to filter by mark from kernel-space. This change ensures backward compatibility with kernels with no support for filtering by mark (Linux kernel <= 3.4.x). This requires lastest libnetfilter_conntrack library. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: fix setting fixed-timeout status flagPablo Neira Ayuso2012-01-231-0/+11
| | | | | | | | | | | | | | | % conntrack -U -u FIXED_TIMEOUT conntrack v1.0.1 (conntrack-tools): Operation failed: Device or resource busy With this patch, you can make indeed make it: % conntrack -U -u FIXED_TIMEOUT [...] conntrack v1.0.1 (conntrack-tools): 8 flow entries have been updated. This patch also adds the corresponding simple QA tests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add expectation support for `-o' optionPablo Neira Ayuso2012-01-221-7/+64
| | | | | | | | | | | | | | Now you can dump expectations in XML format and display the timestamp. conntrack -L exp -o xml,timestamp <?xml version="1.0" encoding="utf-8"?> <expect> <flow><layer3 protonum="2" protoname="ipv4"><expected><src>192.168.1.135</src><dst>130.89.148.12</dst></expected><mask><src>255.255.255.255</src><dst>255.255.255.255</dst></mask><master><src>192.168.1.135</src><dst>130.89.148.12</dst></master></layer3><layer4 protonum="6" protoname="tcp"><expected><sport>0</sport><dport>32877</dport></expected><mask><sport>0</sport><dport>65535</dport></mask><master><sport>49881</sport><dport>21</dport></master></layer4><meta><helper-name>ftp</helper-name><timeout>294</timeout><when><hour>21</hour><min>22</min><sec>09</sec><wday>1</wday><day>22</day><month>1</month><year>2012</year></when></meta></flow> </expect> You have to upgrade libnetfilter_conntrack to access this feature. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add missing break when parsing --id/--secmark optionsFlorian Westphal2011-07-081-0/+1
| | | | | | | | | | | commit 147ed522f52a62ab0d854ddc443d27d97dbf6cdf (conntrack: add support for mark mask) failed to add a break after secmark/id option parsing. Results in '-m 42 -c 1' to search for mark 1 instead of 42. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: remove unused variable with -SPablo Neira Ayuso2011-06-221-3/+2
| | | | | | | | Error: UNUSED_VALUE: conntrack-tools-1.0.0/src/conntrack.c:1297: returned_pointer: Pointer "nl" returned by "strchr(buf, 10)" is never used. Reported-by: Jiri Popelka <jpopelka@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: skip sending update message to kernel if conntrack is unchangedFlorian Westphal2011-06-151-0/+6
| | | | | | | | | | | | This speeds up operation when a lot of conntracks exist, but only a few of them have to be altered. This change is user-visible because the exit message ("%d flow entries have been updated") will now print the number of entries that have been altered instead of the total number of conntracks seen. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for mark maskFlorian Westphal2011-06-151-1/+67
| | | | | | | | | | | | | | | Extend --mark option to optionally take a mask, seperated by '/', e.g. --mark 0x80/0xf0. When used with -L, only test those bits of the mark that are in the mask range (behaves like iptables like -m mark). When used with -U, zero out those bits indicated by the mask and XOR the new mark into the result (behaves like iptables -j MARK --set-xmark). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: display informative message if expectation table is flushedPablo Neira Ayuso2011-02-221-0/+2
| | | | | | | | | | | With this patch, we display the following message after: # conntrack -F expect conntrack v0.9.15 (conntrack-tools): expectation table has been emptied. To make it consistent with the message displayed with conntrack -F. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: allocate template objects in the heapPablo Neira Ayuso2011-02-171-61/+89
| | | | | | | | | | With this patch, we don't abuse the stack anymore, instead we allocate the template objects that are used in the heap. We stop using nfct_maxsize() which is now deprecated in libnetfilter_conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add -o ktimestamp option (it requires linux >= 2.6.38)Pablo Neira Ayuso2011-02-171-2/+7
| | | | | | | | | | | | | | | | | | | | | | | This option requires Linux kernel >= 2.6.38, you have to enable conntrack timestamping with: echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp # conntrack -L -o ktimestamp udp 17 59 src=192.168.1.128 dst=192.168.1.1 sport=52050 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=52050 [ASSURED] mark=0 delta-time=121 [start=Thu Feb 17 17:41:18 2011] use=1 # conntrack -L conntrack v0.9.15 (conntrack-tools): 20 flow entries have been shown. udp 17 31 src=192.168.1.128 dst=192.168.1.1 sport=52050 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=52050 [ASSURED] mark=0 delta-time=149 use=1 # conntrack -E -o ktimestamp ... [DESTROY] udp 17 src=192.168.1.128 dst=192.168.1.1 sport=40162 dport=53 src=192.168.1.1 dst=192.168.1.128 sport=53 dport=40162 [ASSURED] delta-time=3 [start=Thu Feb 17 17:44:57 2011] [stop=Thu Feb 17 17:45:00 2011] # conntrack -E [DESTROY] udp 17 src=192.168.1.128 dst=77.226.252.14 sport=123 dport=123 src=77.226.252.14 dst=192.168.1.128 sport=123 dport=123 delta-time=8 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: allow to listen to all kind of expectation eventsPablo Neira Ayuso2010-10-121-8/+55
| | | | | | | So far, conntrack only allows to listen to events of new expectations. With this patch, we can listen to events of destroyed expectations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>