summaryrefslogtreecommitdiffstats
path: root/src/netlink.c
Commit message (Collapse)AuthorAgeFilesLines
* conntrackd: add TCP flags supportPablo Neira Ayuso2018-03-201-37/+19
| | | | | | | | | | | | | | Back in 2008, there was no TCP flags support in the kernel, hence the workaround was to infer the flags from the TCP state. This patch is implicitly fixing a problem, since the existing RETRANS and UNACK TCP conntrack states plus the _CLOSE_INIT flag that is bogusly infered (to be frank, it was correctly infered back in 2008, but after adding new TCP states, it was not). Let's just use the flags that we get via synchronization messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Use <fcntl.h> instead of legacy synonym <sys/fcntl.h>Felix Janda2015-05-211-1/+1
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: deprecate `Family' in configuration filePablo Neira Ayuso2013-07-061-6/+6
| | | | | | | | | | | | | | | | | | | | | | This patch deprecates the `Family' tweak in the configuration file. Several reasons for this: * If not specified, this was default to IPv4 only in table dumps from the kernel. However, non-IPv4 events were still received. This is inconsistent. * It's an early tweak that was not documented (not included in any of the example files). If we want to support any sort of consistent filtering based on the family, this should happen in the filtering code. After this patch, conntrackd uses AF_UNSPEC to dump the conntrack and expectation tables from the kernel. Reported-by: Bill Fink <billfink@mindspring.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: implement selective flushing for `-t' and `-F' commandsPablo Neira Ayuso2012-07-301-2/+35
| | | | | | | | | | | | | | | | | | | This patch changes the current behaviour of `-t' and `-F' commands, that results in flushing the kernel conntrack table. With this patch, the entries that match the Filter clauses in conntrackd.conf are ignored. This fixes the situation in which some local ssh connection to the firewall is lost during the failover (since `-t' is invoked from the primary-backup.sh script). Note that the Filter clause tells what entries have to be ignored, ie. the entries that do not need to be replicated. It makes sense not to flush entries that are not replicated (usually traffic to the local firewall). Reported-by: Gaurav Sinha <gaurav.sinha@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: support for expectation synchronizationPablo Neira Ayuso2012-01-101-2/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support to synchronize expectations between firewalls. This addition aims to re-use as much as possible of the existing infrastructure for stability reasons. The expectation support has been tested with the FTP helper. This extension requires libnetfilter_conntrack 1.0.0. If this is the first time you're playing with conntrackd, I *strongly* recommend you to get working setup of conntrackd without expectation support before as described in the documentation. Then, enabling expectation support is rather easy. To know more about expectations, if you're not familiar with them, I suggest you to read: "Netfilter's Connection Tracking System" http://people.netfilter.org/pablo/docs/login.pdf Reprinted from ;login: The Magazine of USENIX, vol. 31, no. 3 (Berkeley, CA: USENIX Association, 2006, pp40-45.) In short, expectations allow one Linux firewall to filter multi-flow traffic like FTP, SIP and H.323. In my testbed, there are two firewalls in a primary-backup configuration running keepalived. The use a couple of floating cluster IP address (192.168.0.100 and 192.168.1.100) that are used by the client. These firewalls protect one FTP server (192.168.1.2) that will be accessed by one client. In ASCII art, it looks like this: 192.168.0.100 192.168.1.100 eth1 eth2 fw-1 / \ FTP -- client ------ ------ server -- 192.168.0.2 \ / 192.168.1.2 fw-2 This is the rule-set for the firewalls: -A POSTROUTING -t nat -s 192.168.0.2/32 -d 192.168.1.2/32 -j SNAT --to-source 192.168.1.100 -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -m state --state INVALID -j DROP -A FORWARD -m state --state RELATED -j ACCEPT -A FORWARD -i eth2 -m state --state ESTABLISHED -j ACCEPT -A FORWARD -i eth1 -p tcp -m tcp --dport 21 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT -A FORWARD -i eth1 -p tcp -m state --state ESTABLISHED -j ACCEPT -A FORWARD -m state --state INVALID -j LOG --log-prefix "invalid: " The following steps detail how to check that the expectation support works fine for conntrackd: 1) You have to enable the expectation support in the configuration file with the following option: Sync { ... Options { ExpectationSync { ftp sip h323 } } } This enables expectation synchronization for the FTP, SIP and H.323 helpers. You can alternatively use: Sync { ... Options { ExpectationSync On } } To enable expectation synchronization for all helpers. 2) Make sure you have loaded the FTP helper in both firewalls. root@fw1# modprobe nf_conntrack_ftp root@fw2# modprobe nf_conntrack_ftp 3) Switch to the client. Start one FTP control connection to one server that is protected by the firewalls, enter passive mode: (term-1) user@client$ nc 192.168.1.2 21 220 dummy FTP server USER anonymous 331 Please specify the password. PASS nothing 230 Login successful. PASV 227 Entering Passive Mode (192,168,1,2,163,11). This means that port 163*256+11=41739 will be used for the data traffic. Read this if you are not familiar with the FTP protocol: http://www.freefire.org/articles/ftpexample.php 3) Switch to fw-1 (primary) to check that the expectation is in the internal cache. root@fw1# conntrackd -i exp proto=6 src=192.168.0.2 dst=192.168.1.2 sport=0 dport=41739 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.0.2 master-dst=192.168.1.2 sport=36390 dport=21 [active since 5s] 4) Switch to fw-2 (backup) to check that the expectation has been successfully replicated. root@fw2# conntrackd -e exp proto=6 src=192.168.0.2 dst=192.168.1.2 sport=0 dport=41739 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.0.2 master-dst=192.168.1.2 sport=36390 dport=21 [active since 8s] 5) Make the primary firewall fw-1 fail. Now fw-2 becomes primary. 6) Switch to fw-2 (primary) to commit the external cache into the kernel. root@fw2# conntrackd -c exp The logs should display that the commit was successful: root@fw2# tail -100f /var/log/conntrackd.log [Wed Dec 7 22:16:31 2011] (pid=19195) [notice] committing external cache: expectations [Wed Dec 7 22:16:31 2011] (pid=19195) [notice] Committed 1 new entries [Wed Dec 7 22:16:31 2011] (pid=19195) [notice] commit has taken 0.000366 seconds 7) Switch to the client. Open a new terminal and connect to the port that has been announced by the server: (term-2) user@client$ nc -vvv 192.168.1.2 41739 (UNKNOWN) [192.168.1.2] 41739 (?) open 8) Switch to term-1 and ask for the file listing: [...] 227 Entering Passive Mode (192,168,1,2,163,11). LIST 9) Switch to term-2, it should display the listing. That means everything has worked fine. You may want to try disabling the expectation support and repeating the steps to check that *it does not work* without the state-synchronization. You can also display expectation statistics by means of: root@fwX# conntrackd -s exp This update requires no changes in the primary-backup.sh script that is used by the HA manager to interact with conntrackd. Thus, we provide a backward compatible command line interface. Regarding the Filter clause and expectations, we use the master conntrack to filter expectation events. The filtering is performed in user-space. No kernel-space filtering support for expectations yet (this support should go in libnetfilter_conntrack at some point). This patch also includes support to disable caching and to allow direct injection of expectations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: remove use of deprecated nfct_maxsize()Pablo Neira Ayuso2011-02-181-8/+9
| | | | | | | This patch removes the use of nfct_maxsize() and several abusive stack-based allocations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: setup event reliability after handler creationPablo Neira Ayuso2010-07-071-12/+13
| | | | | | | This patch enables the event reliability in an early stage of the event handler initialization. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: enforce strict logic for NetlinkBufferSize[*] clausesMohit Mehta2010-07-071-14/+20
| | | | | | | | | | | | | | | - NetlinkBufferSize value passed to the kernel gets doubled [see SO_RCVBUF in net/core/sock.c]; it's halved now before it gets sent to the kernel. This ensures that daemon starts up with a netlink socket buffer size equal to the value set for NetlinkBufferSize in configuration file. - Previously, netlink socket buffer size would only stop increasing after it had increased beyond NetlinkBufferSizeMaxGrowth value. With this commit netlink socket buffer size increases as long as it is less than or equal to NetlinkBufferSizeMaxGrowth value. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: update error message for max netlink socket size reachedMohit Mehta2010-07-011-2/+2
| | | | | | | It must refer to NetlinkBufferSize[*] instead of "SocketBufferSize[*]. Signed-off-by: Mohit Mehta <mohit.mehta@vyatta.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: complete TCP window scale supportPablo Neira Ayuso2010-06-171-0/+4
| | | | | | | | | | In commit 56817d1c0cc30bcd65c56c2f73634b256603cc4d, I added the TCP window scale factor support but it was incomplete. We have to set the IP_CT_TCP_FLAG_WINDOW_SCALE flag to update the td_scale field via ctnetlink. Check nlattr_to_tcp(...) function in nf_conntrack_proto_tcp.c for more details. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add support for TCP window scale factor synchronizationPablo Neira Ayuso2010-02-111-10/+10
| | | | | | | This patch adds a new option TCPWindowTracking that allows not to disable TCP window tracking as it occurs by default. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add clause to enable ctnetlink reliable event deliveryPablo Neira Ayuso2009-07-211-0/+12
| | | | | | | | This patch adds the NetlinkEventsReliable clause, this is useful to turn on reliable Netlink event delivery. This features requires a Linux kernel >= 2.6.31. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: fix wrong TCP handling in unused nl_update_conntrack()Pablo Neira Ayuso2009-06-211-1/+1
| | | | | | | | | | | This patch fixes an incorrect use of nfct_get_attr_u32() instead of nfct_get_attr_u8() to obtain the current TCP state. This patch also sets the IP_CT_TCP_FLAG_CLOSE_INIT for states >= TIME_WAIT. The function nl_update_conntrack() is currently unused so this fix does not resolve any pending issue. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: use u8 getter for TCP statesPablo Neira Ayuso2009-02-211-1/+1
| | | | | | | | This patch replace nfct_get_attr_u32 by nfct_get_attr_u8 which is the correct size of a TCP state. Set also the CLOSE_INIT flag for CLOSE TCP state (as nf_conntrack_proto_tcp allows). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove obsolete debug() and debug_ct() callsPablo Neira Ayuso2009-02-201-1/+0
| | | | | | | This patch removes debug() and debug_ct(), I haven't use the debugging information that these functions provide in years. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: refactorize several nl_init_*_handler() functionsPablo Neira Ayuso2009-02-051-36/+0
| | | | | | | | | | This patch removes: * nl_init_dump_handler() * nl_init_request_handler() * nl_init_resync_handler() since they all look very similar. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: set IP_CT_TCP_FLAG_CLOSE_INIT for TIME_WAIT statesPablo Neira Ayuso2009-01-251-0/+13
| | | | | | | | | This patch sets IP_CT_TCP_FLAG_CLOSE_INIT if the entry is in TCP TIME_WAIT state. This patch is a workaround, the daemon should propagate the internal TCP flags to make it fully independent of possible changes in the TCP tracking code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: mangle timeout inside nl_*_conntrack() functionsPablo Neira Ayuso2009-01-251-2/+12
| | | | | | This patch moves the timeout mangling inside nl_*_conntrack(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: remove nl_exist_conntrack() functionPablo Neira Ayuso2009-01-251-13/+2
| | | | | | | This function is a synonimous of nl_get_conntrack(), use the get function instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename overrun handler to resync handlerPablo Neira Ayuso2009-01-171-2/+2
| | | | | | | | | This patch is a cleanup. The overrun handler is actually a way to resynchronize against the conntrack kernel table. The name overrun was used because it was initially its purpose. The new naming shows its genericity. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for redundant dedicated linksPablo Neira Ayuso2009-01-171-0/+16
| | | | | | | | This patch adds support for redundant dedicated links. You can add a pool of dedicated links that can be used if the current active fails. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: don't double the netlink buffer twice during resizePablo Neira Ayuso2009-01-141-1/+2
| | | | | | | | The Linux kernel doubles the the size of the buffer by default. See sock_setsockopt() in net/core/sock.c. We don't need to multiply the current size by two. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix type in warning message on SocketBufferSizeMaxGrowthPablo Neira Ayuso2008-12-171-1/+1
| | | | | | This patch fixes a type in a warning message. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: log report initial netlink event socket buffer sizePablo Neira Ayuso2008-12-171-7/+9
| | | | | | | This patch adds an initial log message to report the initial netlink event socket buffer size. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: do not build the reply tuple in update messagesPablo Neira Ayuso2008-12-111-2/+0
| | | | | | We do not need to include the reply tuple in the update messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: conditional build of TCP flags/mask for updatesPablo Neira Ayuso2008-12-111-6/+8
| | | | | | | This patch includes the TCP flag/mask attributes in update messages if this is a TCP connection. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: build TCP flags/mask only if this is a TCP connectionPablo Neira Ayuso2008-12-111-6/+8
| | | | | | | This patch includes the TCP flag/mask attributes if this is a TCP connection, otherwise do not include. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix EILSEQ error messages due to process race conditionPablo Neira Ayuso2008-12-111-16/+16
| | | | | | | | | | | | | | | | | | | | | This patch fixes a race condition that triggers EILSEQ errors (wrong sequence message). The problems is triggered when the child process resets the timers at the same time that the parent process requests a resync. Since both the child and the parent process use the same descriptors, the sequence tracking code in libnfnetlink gets confused as it considers that it is receiving out of sequence netlink messages. This patch introduces internal handlers to commit and reset timers so that the parent and the child do not use the same descriptors to operate with the kernel. This patch changes the prototype of all nf_*_conntrack() functions. Now, the nfct handler is passed as first parameter, this change is required to fix this problem. The rest of the changes on the API is done for consistency. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: recover conntrackd -F operationPablo Neira Ayuso2008-12-091-0/+5
| | | | | | | | | This patch recovers the option -F for conntrackd. This will be particularly useful to flush the kernel conntrack table without getting the event notification of the conntrack deletions (that will happen with Linux kernel >= 2.6.29). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: unset ATTR_HELPER_NAME to avoid EBUSY in nl_update_conntrack()Pablo Neira Ayuso2008-12-081-0/+3
| | | | | | | This patch unsets the ATTR_HELPER_NAME attributes, otherwise we hit EBUSY for related conntrack entries while resetting the timers. Signed-off: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: constify conntrack object parameter of nl_*_conntrack()Pablo Neira Ayuso2008-12-071-4/+5
| | | | | | | This patch constifies the first parameter, which is a conntrack object, in all nl_*_conntrack() functions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: use NFCT_Q_[CREATE|UPDATE] instead of NFCT_Q_CREATE_UPDATEPablo Neira Ayuso2008-12-071-2/+2
| | | | | | | | | | | | | | | | This patch uses NFCT_Q_CREATE in nl_create_conntrack() and NFCT_Q_UPDATE in nl_update_conntrack(). The NFCT_Q_CREATE_UPDATE query does not set the NLM_F_EXCL flag, so that it tries to update the entry if we fail to create. Under several scenarios, this may lead to problems. For example, the creation of related conntracks contain the master information. This is fine to create an entry, but an update will hit EOPNOTSUPP as ctnetlink considers that you are trying to change the master of an existing conntrack - and this is not a supported operation, of course. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: clone conntrack object while creation/updatePablo Neira Ayuso2008-12-061-6/+22
| | | | | | | | | | | | | | | | | This patch changes the behaviour of nl_create_conntrack() and nl_update_conntrack() which now clone the conntrack object received as parameter. This was not required as these functions were called inside fork(), thus, they modified a copy of the real conntrack objects in the child process. However, this behaviour is broken following the try-again logic in __do_commit_step. For example, if we try to update an expected conntrack object that has vanished for whatever reason, since nl_update_conntrack() modifies the object (unset the master conntrack information), nl_create_conntrak() will create an entry without the master conntrack information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move callbacks to run.c for better readabilityPablo Neira Ayuso2008-11-271-134/+32
| | | | | | | | | This patch is a cleanup. It moves the callbacks from netlink.c to run.c where they are actually invoked. This is better for code readability as I usually have to switch from run.c to netlink.c to remember what the callbacks actually do. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: choose the filtering method via configuration filePablo Neira Ayuso2008-11-181-3/+5
| | | | | | | | | | | | | | | | This patch changes the current behaviour of the filtering selection. Up to now, conntrackd has used the kernel version to select the filtering method based on the following logic: If kernel is >= 2.6.26 we use BSF-based filtering from kernel-space, otherwise, default to userspace. However, this filtering method still lacks of IPv6 support and it requires a patch that got into 2.6.29 to filter IPv6 addresses from kernel-space. To fix this issue, we default to user-space filtering and let the user choose the method via the configuration file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: do not filter in user-space if kernel supports BSFPablo Neira Ayuso2008-10-211-5/+6
| | | | | | | | | This patch avoids a double filtering in user-space and kernel-space if the kernel support BSF. Since we do not use BSF for dumps and resyncs, we add a new parameter to ignore_conntrack to indicate if we have to perform the filtering in user-space or not. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: report when kernel-space event filtering is in usePablo Neira Ayuso2008-10-211-0/+1
| | | | | | | This patch adds a log message to tell that conntrackd are using kernel-space filtering. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: check if kernel-space filtering is availablePablo Neira Ayuso2008-09-171-10/+7
| | | | | | | | Check if the Linux kernel is >= 2.6.26, otherwise it does not support kernel-space filtering. This is not clean but we have no choice, the BSF infrastructure does not return ENOTSUPP for unsupported operations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: fix NAT detection tweakPablo Neira Ayuso2008-09-161-12/+0
| | | | | | | | With this patch, we rely on the real source and destination of the packet to perform the filter. The current NAT detection tweak is broken for certain situations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: avoid errors related to the expected bit handlingPablo Neira Ayuso2008-08-071-2/+15
| | | | | | | | We hit error if we try to change the expected bit for already existing conntracks. On the other hand, if the conntrack does not exist, do not change the expected bit, otherwise we also hit error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache iterators: commit master entries before related onesPablo Neira Ayuso2008-08-071-0/+12
| | | | | | Commit master entries before related ones to avoid ENOENT errors. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: add getter and check existence functionsPablo Neira Ayuso2008-08-071-2/+23
| | | | | | | | | | This patch adds nl_get_conntrack and it changes the behaviour of nl_exist_conntrack. Now, nl_get_conntrack requests the kernel for a conntrack and updates the cached entry. On the other hand, nl_exist_conntrack only inquiries for the existence of the entry. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add more sanity checks in the input pathPablo Neira Ayuso2008-08-011-0/+38
| | | | | | | Some users have reported crashes when nf_conntrack_ipv6 was not present. This patch performs more robust sanity checks in the input path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add support for kernel-space filtering via BSFPablo Neira Ayuso2008-07-231-0/+14
| | | | | | | This patch adds support for kernel-space filtering via BSF by means of the libnetfilter_conntrack's BSF high-level API. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Major rework of the user-space event filteringPablo Neira Ayuso2008-07-221-14/+2
| | | | | | | | | | This patch reworks the user-space filtering. Although we have kernel-space filtering since Linux kernel >= 2.6.26, we keep userspace filtering to ensure backward compatibility. Moreover, this patch prepares the implementation of the kernel-space filtering via libnetfilter_conntrack's high-level berkeley socket filter API. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* use only the original tuple to check if a conntrack is presentPablo Neira Ayuso2008-06-161-1/+9
|
* improve netlink overrun handling/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-091-0/+21
|
* fix asymmetric path support (still some open concerns)/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-081-0/+31
|
* revert relicensing... still we use linux_list.h code which seems to be GPLv2 ↵/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-03-081-1/+1
| | | | only which is incompatible AFAIK
* relicense conntrack-tools as GPLv3+, so far the most significant contributor ↵/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-03-081-1/+1
| | | | has been Max Kellermann and has no issues with relicensing their contributions.