summaryrefslogtreecommitdiffstats
path: root/src/sync-mode.c
Commit message (Collapse)AuthorAgeFilesLines
* sync-mode: fix broken dedicated-link change in multichannel layerPablo Neira Ayuso2009-03-201-12/+5
| | | | | | | This patch fixes a problem that was introduced while adding the multichannel support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-mode: change `multicast' by `link' for `-s' optionPablo Neira Ayuso2009-03-171-1/+1
| | | | | | | | | This patch obsoletes `-s multicast' by `-s link' to display the dedicated link statistics, as the current dedicated link protocol use can be unicast UDP or multicast. The term "link" is more generic. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-mode: cleanup reminiscent of multicast dependencyPablo Neira Ayuso2009-03-171-2/+2
| | | | | | | | | This patch is a cleanup, it removes a couple of reminiscent references to multicast (as now conntrackd is independent of the protocol used to replicate state-changes, currently supports unicast UDP and multicast). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-mode: save one tab inside switch, cleanupPablo Neira Ayuso2009-03-131-14/+14
| | | | | | This patch saves one tab in the code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-mode: fix wrong output stats refering lost/malformed packetsPablo Neira Ayuso2009-03-131-3/+3
| | | | | | | | This patch fixes a misleading output that shows the number of lost and malformed packets. Instead, those numbers show the number of the number of lost and malformed messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-mode: add abstract layer to make daemon independent of multicastPablo Neira Ayuso2009-03-121-52/+30
| | | | | | | | | This patch reworks conntrackd to make it independent of the protocol used to propagate state-changes. This patch adds the channel layer abstraction, this layer allows you to add support for different protocols like unicast UDP or TIPC. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-mode: rename mcast_iface structure to interfacePablo Neira Ayuso2009-03-091-13/+13
| | | | | | | | | This patch renames the mcast_iface to interface since this nlif handler is not related with multicast itself, but to monitor the link interface used to propagate state-changes. This patch is a cleanup. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-mode: rename mcast_send_sync() to sync_send()Pablo Neira Ayuso2009-03-091-7/+7
| | | | | | | | This patch is a cleanup. It renames the function mcast_send_sync() to sync_send() since the function itself is not related to multicast anymore (it enqueues state-changes to the upper layer). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix compilation issue in gentoo due to missing include limits.hPablo Neira Ayuso2009-02-211-0/+1
| | | | | | | | | This patch adds include limits.h to mcast.c and sync-mode.c. Why Gentoo maintainers did not report me the problem? :( http://bugs.gentoo.org/show_bug.cgi?id=256497 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove obsolete debug() and debug_ct() callsPablo Neira Ayuso2009-02-201-20/+6
| | | | | | | This patch removes debug() and debug_ct(), I haven't use the debugging information that these functions provide in years. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-mode: change current link if message is correctPablo Neira Ayuso2009-02-201-3/+10
| | | | | | | This patch makes conntrackd change the current dedicated link if the message is correct, ie. neither malformed nor out-of-sync. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add `-f internal' and `-f external' optionsPablo Neira Ayuso2009-02-151-0/+10
| | | | | | | | This patch allows flushing the internal and/or the external cache. The `-f' with no extra parameters still works to flush both the internal and the external cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use resync handler for polling instead of dump handlerPablo Neira Ayuso2009-02-141-12/+14
| | | | | | | | This patch moves the polling logic into the resync handler. The dump handler action depended on the daemon working mode (polling or event-driven) resulting in an inconsistent behaviour. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-mode: flush also internal cache after reset PurgeTimeoutPablo Neira Ayuso2009-02-081-0/+1
| | | | | | | | | | Currently, the daemon sends a flush request to the kernel-space. With lots of entries and NetlinkOverrunResync disabled, the daemon remains in an inconsistent state due to an overrun produced by the flush report to userspace. With this patch, the daemon also flush its internal cache after the kernel flush request. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: re-work polling strategyPablo Neira Ayuso2009-02-061-11/+17
| | | | | | | | This patch improves the polling support included in 0.9.10. The polling now consists of getting the state table, wait for PollSecs, then purge obsolete entries, and so on. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: change behaviour of `-t' optionPablo Neira Ayuso2009-01-251-5/+18
| | | | | | | | | | With this patch, the `-t' option adds an alarm that will flush the cache after CONFIG(purge_timeout) seconds specified in the config file. This looks much cleaner and more performance that looping on the entire conntrack table to set the new timeout of every single entry. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove register_fds hooksPablo Neira Ayuso2009-01-171-19/+12
| | | | | | | This patch moves the file descriptor registration after the initialization instead of having a specific hook for this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename overrun handler to resync handlerPablo Neira Ayuso2009-01-171-6/+6
| | | | | | | | | This patch is a cleanup. The overrun handler is actually a way to resynchronize against the conntrack kernel table. The name overrun was used because it was initially its purpose. The new naming shows its genericity. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for redundant dedicated linksPablo Neira Ayuso2009-01-171-22/+87
| | | | | | | | This patch adds support for redundant dedicated links. You can add a pool of dedicated links that can be used if the current active fails. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync: enqueue state updates to tx_queuePablo Neira Ayuso2009-01-171-12/+11
| | | | | | | | | | With this patch, all the states updates are enqueued in the tx_queue. Thus, there's a single output path. This patch adds a simple refcounting mechanism to note when an object is sitting in the txqueue. This patch also removes the alarm that is required by the ftfw approach. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync: add generic tx_queue for all synchronization modesPablo Neira Ayuso2009-01-171-4/+12
| | | | | | This patch adds a generic tx queue for all synchronization modes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync: unify tx_list and tx_queue into one single tx_queuePablo Neira Ayuso2009-01-151-14/+6
| | | | | | | | | | | | | | | | | | | This patch unifies the tx_list and the tx_queue to have only one transmission queue. Since the tx_list hold state objects and tx_queue control messages, I have introduced a queue node type that can be used to differenciate the kind of information that the node stores: object or control message. This patch also reworks the existing queue class to include a file descriptor that can be used to know if there are new data added to the queue (see QUEUE_F_EVFD flag). In this change, I have also modified the current evfd to make the file descriptor to make read operations non-blocking. Moreover, it keeps a counter that is used to know how many messages are inserted in the queue. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rework of the hash-cache infrastructurePablo Neira Ayuso2009-01-151-55/+61
| | | | | | | | | | | | | | | | | | | | | | | | Currently, the caching system is implemented in a two layer architecture: hashtable (inner layer) and cache (upper layer). This patch reworks the hash-cache infrastructure to solve some initial design problems to make it more flexible, the main strong points of this patch are: * Memory handling is done in the cache layer, not in the inner hashtable layer. This removes one of the main dependencies between the hashtable and the cache classes. * Remove excessive encapsulation: the former cache used to hide a lot of details of the inner hashtable implementation. * Fix over-hashing of some operations: lookup-delete-add required three hash calculations. Similarly, the update-or-add operation required two hash calculations. Now, we calculate the hash once and re-use the value how many times as we need. This patch simplifies the caching system. As a result, we save ~130 lines of code. Small code means and less complexity means less chance to have bugs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-mode: remove unnecessary split linesPablo Neira Ayuso2008-12-211-6/+3
| | | | | | This patch removes unnecessary split lines in several log messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add cache statistics via `-s cache'Pablo Neira Ayuso2008-12-211-3/+4
| | | | | | | | | | | | This patch adds cache statistics that you can check via `conntrackd -s cache'. This information is useful for trouble-shooting. This patch replaces several log messages that can be triggered in runtime. The idea behind this patch is to avoid log message flooding under errors. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add network statistics via `-s network'Pablo Neira Ayuso2008-12-211-21/+62
| | | | | | | | | | | | This patch adds networks statistics that you can check via `conntrackd -s network'. This information is useful for trouble-shooting. This patch replaces several log messages that can be triggered in runtime. The idea behind this patch is to avoid log message flooding under errors. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sync-mode: check if message type is >= NET_T_STATE_MAX before parsingPablo Neira Ayuso2008-12-131-0/+5
| | | | | | | This patch adds a message-type checking before we parse the message. Thus, we skip the parsing of messages with bad types. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ftfw: shrink alive message sizePablo Neira Ayuso2008-12-131-1/+1
| | | | | | | | | | This patch reduces the size of alive messages by removing the "from" and "to" fields which are not of any help. This patch also removes the IS_CTL() macro since it does not return true for the control messages anymore but only for IS_ACK(), IS_NACK() and IS_RESYNC(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: use NET_T_* instead of NFCT_Q_*Pablo Neira Ayuso2008-12-131-8/+8
| | | | | | | | This patch replaces the use of NFCT_Q_* in the message type by specific network message type NET_T_*. The query types are reserved for libnetfilter_conntrack operations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: remove the netpld header from the messagesPablo Neira Ayuso2008-12-081-7/+4
| | | | | | | | | This patch simplifies the message format of the replication messages. As a result, we save four bytes. The netpld header was introduced in the early protocol design. Today, it does not have any reason to exist. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: remove length parameter of mcast_buffered_send_netmsg()Pablo Neira Ayuso2008-12-081-1/+1
| | | | | | | | This patch simplifies mcast_buffered_send_netmsg() by removing the length parameter. Instead, we use the length field in the nethdr to know the message size to be sent. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: make tx buffer initialization independent of mcast configPablo Neira Ayuso2008-11-301-1/+1
| | | | | | | | | | This patch changes the prototype of mcast_buffered_init() to receive as argument the MTU size instead of the multicast configuration. This decouples the initialization of the tx buffer from the multicast configuration. This patch is needed by the multi-dedicated link support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move callbacks to run.c for better readabilityPablo Neira Ayuso2008-11-271-1/+1
| | | | | | | | | This patch is a cleanup. It moves the callbacks from netlink.c to run.c where they are actually invoked. This is better for code readability as I usually have to switch from run.c to netlink.c to remember what the callbacks actually do. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* network: add protocol version field (breaks backward compatibility)Pablo Neira Ayuso2008-11-021-1/+7
| | | | | | | | | | | | | This patch adds the version field (8-bits long) to the nethdr structure. This fields can be used to indicate the protocol version in case that we detect an incompatibility between two conntrackd daemons working with different protocol versions. Unfortunately, this patch breaks backward compatibility, ie. conntrackd <= 0.9.8 protocol is not compatible with the upcoming conntrackd >= 0.9.9. Better do this now than later. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: do not filter in user-space if kernel supports BSFPablo Neira Ayuso2008-10-211-1/+1
| | | | | | | | | This patch avoids a double filtering in user-space and kernel-space if the kernel support BSF. Since we do not use BSF for dumps and resyncs, we add a new parameter to ignore_conntrack to indicate if we have to perform the filtering in user-space or not. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache iterators: rework cache_reset_timersPablo Neira Ayuso2008-08-071-15/+0
| | | | | | | | | | | This patch adds the clause PurgeTimeout that sets the new timer when conntrackd -t is called. This command is particularly useful when the sysadmin triggers hand-overs between several nodes without rebooting as it reduces the timers of the remaining entries in the kernel. Thus, avoiding clashes between new and old entries that may trigger INVALID packets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrackd: add -t option to shorten conntrack timeoutsPablo Neira Ayuso2008-08-021-0/+8
| | | | | | | | | | | | | | | | | This patch adds the new option `-t' for conntrackd. This option shortens the value of the timeout for the cached entries that lives in the kernel. This option is particularly useful to remove the zombie established entries that remain in kernel if the user tests the platform by forcing the takeover from one to another node several times. We currently use the value of CommitTimeout which is sane for it. Adding a new option does not seem to add more flexibility IMO. Once we get the patches to notify user changes via ctnetlink and the netlink flag NLM_F_ECHO works, we may directly invoke a massive purge of the entries, however, such solution would still need evaluation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fix broken normal deletion in cachesPablo Neira Ayuso2008-08-011-10/+9
| | | | | | | | | | | | This patch fixes the non-timer-based cache deletion. This bug affects the alarm-based approach since the backup replicas did not get the deletion event, thus, delaying the deletion. This patch introduces cache_find() to look up for a conntrack object and __cache_del_timer() to perform direct deletions by means of the pointer obtained with cache_find(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Major rework of the user-space event filteringPablo Neira Ayuso2008-07-221-4/+0
| | | | | | | | | | This patch reworks the user-space filtering. Although we have kernel-space filtering since Linux kernel >= 2.6.26, we keep userspace filtering to ensure backward compatibility. Moreover, this patch prepares the implementation of the kernel-space filtering via libnetfilter_conntrack's high-level berkeley socket filter API. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rework the HELLO logic inside FT-FWPablo Neira Ayuso2008-05-261-1/+3
|
* add best effort replication protocol (aka NOTRACK)Pablo Neira Ayuso2008-05-251-0/+2
|
* add eventfd emulation to communicate receiver -> senderPablo Neira Ayuso2008-05-251-7/+21
|
* add Mcast[Snd|Rcv]SocketBuffer clauses to tune multicast socket buffersPablo Neira Ayuso2008-05-201-0/+6
|
* improve network message sanity checkingsPablo Neira Ayuso2008-05-181-11/+30
|
* Fix reorder possible reordering of destroy messages under message omission. ↵/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-291-12/+15
| | | | This patch introduces the TimeoutDestroy clause to determine how long a conntrack remains in the internal cache once it has been destroy from the kernel table.
* rework of the FT-FW approach/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-261-26/+20
|
* improve netlink overrun handling/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-091-54/+35
|
* revert relicensing... still we use linux_list.h code which seems to be GPLv2 ↵/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-03-081-1/+1
| | | | only which is incompatible AFAIK
* relicense conntrack-tools as GPLv3+, so far the most significant contributor ↵/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-03-081-1/+1
| | | | has been Max Kellermann and has no issues with relicensing their contributions.
* compose the file descriptor set at initialization stage to save some cycles/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-191-5/+4
|