summaryrefslogtreecommitdiffstats
path: root/src/netlink.c
Commit message (Collapse)AuthorAgeFilesLines
* conntrackd: remove use of deprecated nfct_maxsize()Pablo Neira Ayuso2011-02-181-8/+9
| | | | | | | This patch removes the use of nfct_maxsize() and several abusive stack-based allocations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: setup event reliability after handler creationPablo Neira Ayuso2010-07-071-12/+13
| | | | | | | This patch enables the event reliability in an early stage of the event handler initialization. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: enforce strict logic for NetlinkBufferSize[*] clausesMohit Mehta2010-07-071-14/+20
| | | | | | | | | | | | | | | - NetlinkBufferSize value passed to the kernel gets doubled [see SO_RCVBUF in net/core/sock.c]; it's halved now before it gets sent to the kernel. This ensures that daemon starts up with a netlink socket buffer size equal to the value set for NetlinkBufferSize in configuration file. - Previously, netlink socket buffer size would only stop increasing after it had increased beyond NetlinkBufferSizeMaxGrowth value. With this commit netlink socket buffer size increases as long as it is less than or equal to NetlinkBufferSizeMaxGrowth value. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: update error message for max netlink socket size reachedMohit Mehta2010-07-011-2/+2
| | | | | | | It must refer to NetlinkBufferSize[*] instead of "SocketBufferSize[*]. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: complete TCP window scale supportPablo Neira Ayuso2010-06-171-0/+4
| | | | | | | | | | In commit 56817d1c0cc30bcd65c56c2f73634b256603cc4d, I added the TCP window scale factor support but it was incomplete. We have to set the IP_CT_TCP_FLAG_WINDOW_SCALE flag to update the td_scale field via ctnetlink. Check nlattr_to_tcp(...) function in nf_conntrack_proto_tcp.c for more details. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add support for TCP window scale factor synchronizationPablo Neira Ayuso2010-02-111-10/+10
| | | | | | | This patch adds a new option TCPWindowTracking that allows not to disable TCP window tracking as it occurs by default. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add clause to enable ctnetlink reliable event deliveryPablo Neira Ayuso2009-07-211-0/+12
| | | | | | | | This patch adds the NetlinkEventsReliable clause, this is useful to turn on reliable Netlink event delivery. This features requires a Linux kernel >= 2.6.31. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix wrong TCP handling in unused nl_update_conntrack()Pablo Neira Ayuso2009-06-211-1/+1
| | | | | | | | | | | This patch fixes an incorrect use of nfct_get_attr_u32() instead of nfct_get_attr_u8() to obtain the current TCP state. This patch also sets the IP_CT_TCP_FLAG_CLOSE_INIT for states >= TIME_WAIT. The function nl_update_conntrack() is currently unused so this fix does not resolve any pending issue. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: use u8 getter for TCP statesPablo Neira Ayuso2009-02-211-1/+1
| | | | | | | | This patch replace nfct_get_attr_u32 by nfct_get_attr_u8 which is the correct size of a TCP state. Set also the CLOSE_INIT flag for CLOSE TCP state (as nf_conntrack_proto_tcp allows). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove obsolete debug() and debug_ct() callsPablo Neira Ayuso2009-02-201-1/+0
| | | | | | | This patch removes debug() and debug_ct(), I haven't use the debugging information that these functions provide in years. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: refactorize several nl_init_*_handler() functionsPablo Neira Ayuso2009-02-051-36/+0
| | | | | | | | | | This patch removes: * nl_init_dump_handler() * nl_init_request_handler() * nl_init_resync_handler() since they all look very similar. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: set IP_CT_TCP_FLAG_CLOSE_INIT for TIME_WAIT statesPablo Neira Ayuso2009-01-251-0/+13
| | | | | | | | | This patch sets IP_CT_TCP_FLAG_CLOSE_INIT if the entry is in TCP TIME_WAIT state. This patch is a workaround, the daemon should propagate the internal TCP flags to make it fully independent of possible changes in the TCP tracking code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: mangle timeout inside nl_*_conntrack() functionsPablo Neira Ayuso2009-01-251-2/+12
| | | | | | This patch moves the timeout mangling inside nl_*_conntrack(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: remove nl_exist_conntrack() functionPablo Neira Ayuso2009-01-251-13/+2
| | | | | | | This function is a synonimous of nl_get_conntrack(), use the get function instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename overrun handler to resync handlerPablo Neira Ayuso2009-01-171-2/+2
| | | | | | | | | This patch is a cleanup. The overrun handler is actually a way to resynchronize against the conntrack kernel table. The name overrun was used because it was initially its purpose. The new naming shows its genericity. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for redundant dedicated linksPablo Neira Ayuso2009-01-171-0/+16
| | | | | | | | This patch adds support for redundant dedicated links. You can add a pool of dedicated links that can be used if the current active fails. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: don't double the netlink buffer twice during resizePablo Neira Ayuso2009-01-141-1/+2
| | | | | | | | The Linux kernel doubles the the size of the buffer by default. See sock_setsockopt() in net/core/sock.c. We don't need to multiply the current size by two. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix type in warning message on SocketBufferSizeMaxGrowthPablo Neira Ayuso2008-12-171-1/+1
| | | | | | This patch fixes a type in a warning message. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: log report initial netlink event socket buffer sizePablo Neira Ayuso2008-12-171-7/+9
| | | | | | | This patch adds an initial log message to report the initial netlink event socket buffer size. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: do not build the reply tuple in update messagesPablo Neira Ayuso2008-12-111-2/+0
| | | | | | We do not need to include the reply tuple in the update messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: conditional build of TCP flags/mask for updatesPablo Neira Ayuso2008-12-111-6/+8
| | | | | | | This patch includes the TCP flag/mask attributes in update messages if this is a TCP connection. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: build TCP flags/mask only if this is a TCP connectionPablo Neira Ayuso2008-12-111-6/+8
| | | | | | | This patch includes the TCP flag/mask attributes if this is a TCP connection, otherwise do not include. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix EILSEQ error messages due to process race conditionPablo Neira Ayuso2008-12-111-16/+16
| | | | | | | | | | | | | | | | | | | | | This patch fixes a race condition that triggers EILSEQ errors (wrong sequence message). The problems is triggered when the child process resets the timers at the same time that the parent process requests a resync. Since both the child and the parent process use the same descriptors, the sequence tracking code in libnfnetlink gets confused as it considers that it is receiving out of sequence netlink messages. This patch introduces internal handlers to commit and reset timers so that the parent and the child do not use the same descriptors to operate with the kernel. This patch changes the prototype of all nf_*_conntrack() functions. Now, the nfct handler is passed as first parameter, this change is required to fix this problem. The rest of the changes on the API is done for consistency. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: recover conntrackd -F operationPablo Neira Ayuso2008-12-091-0/+5
| | | | | | | | | This patch recovers the option -F for conntrackd. This will be particularly useful to flush the kernel conntrack table without getting the event notification of the conntrack deletions (that will happen with Linux kernel >= 2.6.29). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: unset ATTR_HELPER_NAME to avoid EBUSY in nl_update_conntrack()Pablo Neira Ayuso2008-12-081-0/+3
| | | | | | | This patch unsets the ATTR_HELPER_NAME attributes, otherwise we hit EBUSY for related conntrack entries while resetting the timers. Signed-off: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: constify conntrack object parameter of nl_*_conntrack()Pablo Neira Ayuso2008-12-071-4/+5
| | | | | | | This patch constifies the first parameter, which is a conntrack object, in all nl_*_conntrack() functions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: use NFCT_Q_[CREATE|UPDATE] instead of NFCT_Q_CREATE_UPDATEPablo Neira Ayuso2008-12-071-2/+2
| | | | | | | | | | | | | | | | This patch uses NFCT_Q_CREATE in nl_create_conntrack() and NFCT_Q_UPDATE in nl_update_conntrack(). The NFCT_Q_CREATE_UPDATE query does not set the NLM_F_EXCL flag, so that it tries to update the entry if we fail to create. Under several scenarios, this may lead to problems. For example, the creation of related conntracks contain the master information. This is fine to create an entry, but an update will hit EOPNOTSUPP as ctnetlink considers that you are trying to change the master of an existing conntrack - and this is not a supported operation, of course. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: clone conntrack object while creation/updatePablo Neira Ayuso2008-12-061-6/+22
| | | | | | | | | | | | | | | | | This patch changes the behaviour of nl_create_conntrack() and nl_update_conntrack() which now clone the conntrack object received as parameter. This was not required as these functions were called inside fork(), thus, they modified a copy of the real conntrack objects in the child process. However, this behaviour is broken following the try-again logic in __do_commit_step. For example, if we try to update an expected conntrack object that has vanished for whatever reason, since nl_update_conntrack() modifies the object (unset the master conntrack information), nl_create_conntrak() will create an entry without the master conntrack information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move callbacks to run.c for better readabilityPablo Neira Ayuso2008-11-271-134/+32
| | | | | | | | | This patch is a cleanup. It moves the callbacks from netlink.c to run.c where they are actually invoked. This is better for code readability as I usually have to switch from run.c to netlink.c to remember what the callbacks actually do. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: choose the filtering method via configuration filePablo Neira Ayuso2008-11-181-3/+5
| | | | | | | | | | | | | | | | This patch changes the current behaviour of the filtering selection. Up to now, conntrackd has used the kernel version to select the filtering method based on the following logic: If kernel is >= 2.6.26 we use BSF-based filtering from kernel-space, otherwise, default to userspace. However, this filtering method still lacks of IPv6 support and it requires a patch that got into 2.6.29 to filter IPv6 addresses from kernel-space. To fix this issue, we default to user-space filtering and let the user choose the method via the configuration file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: do not filter in user-space if kernel supports BSFPablo Neira Ayuso2008-10-211-5/+6
| | | | | | | | | This patch avoids a double filtering in user-space and kernel-space if the kernel support BSF. Since we do not use BSF for dumps and resyncs, we add a new parameter to ignore_conntrack to indicate if we have to perform the filtering in user-space or not. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: report when kernel-space event filtering is in usePablo Neira Ayuso2008-10-211-0/+1
| | | | | | | This patch adds a log message to tell that conntrackd are using kernel-space filtering. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: check if kernel-space filtering is availablePablo Neira Ayuso2008-09-171-10/+7
| | | | | | | | Check if the Linux kernel is >= 2.6.26, otherwise it does not support kernel-space filtering. This is not clean but we have no choice, the BSF infrastructure does not return ENOTSUPP for unsupported operations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: fix NAT detection tweakPablo Neira Ayuso2008-09-161-12/+0
| | | | | | | | With this patch, we rely on the real source and destination of the packet to perform the filter. The current NAT detection tweak is broken for certain situations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: avoid errors related to the expected bit handlingPablo Neira Ayuso2008-08-071-2/+15
| | | | | | | | We hit error if we try to change the expected bit for already existing conntracks. On the other hand, if the conntrack does not exist, do not change the expected bit, otherwise we also hit error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache iterators: commit master entries before related onesPablo Neira Ayuso2008-08-071-0/+12
| | | | | | Commit master entries before related ones to avoid ENOENT errors. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: add getter and check existence functionsPablo Neira Ayuso2008-08-071-2/+23
| | | | | | | | | | This patch adds nl_get_conntrack and it changes the behaviour of nl_exist_conntrack. Now, nl_get_conntrack requests the kernel for a conntrack and updates the cached entry. On the other hand, nl_exist_conntrack only inquiries for the existence of the entry. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add more sanity checks in the input pathPablo Neira Ayuso2008-08-011-0/+38
| | | | | | | Some users have reported crashes when nf_conntrack_ipv6 was not present. This patch performs more robust sanity checks in the input path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add support for kernel-space filtering via BSFPablo Neira Ayuso2008-07-231-0/+14
| | | | | | | This patch adds support for kernel-space filtering via BSF by means of the libnetfilter_conntrack's BSF high-level API. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Major rework of the user-space event filteringPablo Neira Ayuso2008-07-221-14/+2
| | | | | | | | | | This patch reworks the user-space filtering. Although we have kernel-space filtering since Linux kernel >= 2.6.26, we keep userspace filtering to ensure backward compatibility. Moreover, this patch prepares the implementation of the kernel-space filtering via libnetfilter_conntrack's high-level berkeley socket filter API. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* use only the original tuple to check if a conntrack is presentPablo Neira Ayuso2008-06-161-1/+9
|
* improve netlink overrun handling/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-091-0/+21
|
* fix asymmetric path support (still some open concerns)/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-081-0/+31
|
* revert relicensing... still we use linux_list.h code which seems to be GPLv2 ↵/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-03-081-1/+1
| | | | only which is incompatible AFAIK
* relicense conntrack-tools as GPLv3+, so far the most significant contributor ↵/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-03-081-1/+1
| | | | has been Max Kellermann and has no issues with relicensing their contributions.
* From: Max Kellermann <max@duempel.org>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-141-7/+7
| | | | whitespace cleanups
* Max Kellermann <max@duempel.org>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-181-14/+14
| | | | Simplify logging infrastructure
* Max Kellermann <max@duempel.org>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-171-7/+1
| | | | import only required C headers and put local headers on top to check
* Max Kellermann <max@duempel.org>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-171-2/+2
| | | | use C99 integers (uint32_t instead of u_int32_t)
* Max Kellermann <max@duempel.org>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-151-0/+4
| | | | add missing function prototypes