summaryrefslogtreecommitdiffstats
path: root/include/libnetfilter_conntrack/libnetfilter_conntrack.h
Commit message (Collapse)AuthorAgeFilesLines
* conntrack: add nfct_set_attr_l and ATTR_HELPER_INFOPablo Neira Ayuso2012-06-261-0/+6
| | | | | | | | | | | | | | This adds the ATTR_HELPER_INFO that can be used to send binary data that will be attached to the conntrack. This is useful for the user-space connection tracking support. This patch also adds a new interface: nfct_set_attr_l(attr, type, value, length); that is used to set the variable length helper information. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add new API to build/parse ctnetlink messages using libmnlPablo Neira Ayuso2012-05-261-0/+5
| | | | | | | | This patch adds support to build and to parse netlink messages from/to one user-space nf_conntrack object. It uses libmnl, thus libnetfilter_conntrack now depends on this library. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add new API to build/parse ctnetlink messages using libmnlPablo Neira Ayuso2012-05-261-0/+6
| | | | | | | | | | | | | | | This patch adds support to build and to parse netlink messages from/to one user-space nf_conntrack object. It uses libmnl, thus libnetfilter_conntrack now depends on this library. This is the first patch in the direction of removing the dependency on the veteran libnfnetlink. I have decided to update LIBVERSION in this patch. I know it's recommended to do this before releasing the software. I prefer to do this so snapshot packages get the correct LIBVERSION. Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
* conntrack: add new ATTR_GRP_[ORIG|REPL]_ADDR_[SRC|DST] attributePablo Neira Ayuso2012-04-271-0/+10
| | | | | | | | | | | | | | | | | | | | This allows you to set and to get the address for both IPv4 and IPV6 using the same interface. This can simplify much redundant code that needs to support both protocols. This relies on some fixed layout union: union nfct_attr_grp_addr { u_int32_t ip; u_int32_t ip6[4]; u_int32_t addr[4]; }; But I don't see this library will support anything different from IPv4 and IPv6 as layer 3 protocol. If that happens and some point, we can add some new attribute group and deprecate this one. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add support for CTA_MARK_MASK and filtered dumpingPablo Neira Ayuso2012-02-091-1/+30
| | | | | | | | This patch adds the infrastructure to allow filtered dumping. See utils/conntrack_dump_filter.c for instance. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add expectfn supportPablo Neira Ayuso2012-02-061-0/+1
| | | | | | This patch allows you to set expectfn. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add NAT supportPablo Neira Ayuso2012-02-061-0/+2
| | | | | | This patch adds ATTR_EXP_NAT_TUPLE and ATTR_EXP_NAT_DIR attributes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add class supportPablo Neira Ayuso2012-02-061-0/+1
| | | | | | This patch allows you to specify the expectation class. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add nfexp_cmpPablo Neira Ayuso2012-01-041-0/+4
| | | | | | | | | This patch adds nfexp_cmp that allows you to compare two expectation objects. This includes the extension of test_api for this new function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: clarify licensing terms of library (GPLv2+)Pablo Neira Ayuso2011-12-301-3/+5
| | | | | | | | | | | | | | | | This patch is *not* changing the licensing terms of this library (which was initially released under GPLv2 and later on extended to GPLv2+ after contacting all the contributors who kindly agreed to extend it to any later GPL version). Jan says: "In libnetfilter_conntrack, there are many .c files declaring GNU GPL incorporated herein by reference without telling which version(s) exactly apply. Given src/main.c for example is actually GPL-2.0+, the reference made is ambiguous." This patch should definitely clarify this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: export NFCT_HELPER_NAME_MAXPablo Neira Ayuso2011-12-241-0/+5
| | | | | | | NFCT_HELPER_NAME_MAX is 16, which is the maximum helper name allowed since 2.6.29. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: support CTA_EXPECT_HELP_NAMEPablo Neira Ayuso2011-12-241-0/+1
| | | | | | | | This patch adds support for CTA_EXPECT_HELP_NAME. We now have the ATTR_EXP_HELPER_NAME attribute. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add nfexp_send()Pablo Neira Ayuso2011-12-081-0/+5
| | | | | | It is like nfct_send() but for expectations, for API symmetry. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: deprecate low level APIPablo Neira Ayuso2011-02-221-6/+12
| | | | | | | | | | | | This patch deprecates the low level API. This API is not currently used by any known clients (at least, at a quick glance at google). These functions are a problem if we plan to port libnetfilter_conntrack upon libmnl since they contain specific libnfnetlink bits. I have also added __build_query_[ct|exp] to avoid compilation warnings. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: deprecate nfct_sizeof() and nfct_maxsize() functionsPablo Neira Ayuso2011-02-171-2/+2
| | | | | | | | | These functions are evil since they allow the use of memcpy() instead of nfct_copy(). This is a problem because it violates the design principle that the library follows, that is to provide opaque objects in which the client code does not care on the binary layout. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add NFCT_CP_OVERRIDE flag for nfct_copy()Pablo Neira Ayuso2011-02-171-0/+1
| | | | | | | | Thus, we have a fast version of nfct_copy() which allows to copy the destination to the origin. After this call, the destination is a clone of the origin. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* conntrack: add timestamp supportPablo Neira Ayuso2011-02-171-0/+5
| | | | | | | | | | | | This patch adds the connection tracking extension that allows conntrack timestamping. This requires a Linux kernel >= 2.6.38. We have now 65 attributes, we need 96 bits to store what attributes are set in the objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: sync IPS_* bits with current in the Linux kernelPablo Neira Ayuso2011-02-061-1/+9
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for CTA_SECCTXPablo Neira Ayuso2011-01-161-0/+1
| | | | | | | This patch adds support for the new attribute CTA_SECCTX that supersedes CTA_SECMARK. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: export already implement low-level functionsPablo Neira Ayuso2010-11-091-0/+18
| | | | | | | | | | | This patch exports several low-level function that allow to build and parse netlink messages that contain ctnetlink expectation information. They have been in the tree for quite so long, but they were not exported. To leave the library in a consistent state (ctnetlink conntrack functions provide the similar functionality) I have decided to export them. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add support for CTA_EXPECT_FLAGSPablo Neira Ayuso2010-10-071-0/+6
| | | | | | This patch allows to set the expectation flags from user-space. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add CTA_EXPECT_ZONE supportPablo Neira Ayuso2010-10-071-0/+1
| | | | | | | We also remove the reference to CTA_EXPECT_QUEUENR with was not ever pushed into Linux kernel mainline. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: add zone supportPablo Neira Ayuso2010-05-031-0/+1
| | | | | | Add Patrick's zone support for libnetfilter_conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for TCP window scale factorPablo Neira Ayuso2010-02-161-0/+2
| | | | | | | | This patch adds the missing bits to support the modification of the TCP window scale factor in a conntrack entry. The kernel support has been already there since 2.6.23. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* header: counters are 64-bits longPablo Neira Ayuso2010-01-241-4/+4
| | | | | | | | | | This patch fixes wrong comments in the libnetfilter_conntrack.h header file. The counters of the user-space conntrack object has always been 64-bits long (even if during some time they were 32-bits long in the kernel). This does not break backward compatibility, but users (like ulogd2) has to fix this to avoid truncating the counters. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expect: add new callback interface while keeping backward compatibilityPablo Neira Ayuso2009-07-161-0/+11
| | | | | | | | | This patch the new expectation callback interface. This change is like 20ed81b10714dfe78e31e9721e2d4f42b4beabb2 but related to expectations. The netlink message contains the portID that is useful to identify the origin of the message. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename ATTR_DCCP_SEQ by ATTR_DCCP_HANDSHAKE_SEQPablo Neira Ayuso2009-07-161-1/+1
| | | | | | | | | | | This patch renames the attribute constant to access the DCCP handshake sequence number that was recently committed in 19f35b21dbe2bb4386eeced4e0d87f3b2e1dd8bf. No release with the old name has been done, so no problems about backward compatibility although it'd be better if I don't push changes that I have to modify very soon afterwards. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* headers: include u64 get/set prototype in libnetfilter_conntrack.hPablo Neira Ayuso2009-07-161-0/+7
| | | | | | | This patch adds the prototype of the u64 getter/setter to the header file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for DCCP 64-bits sequence number trackingPablo Neira Ayuso2009-07-141-0/+1
| | | | | | | | | From: Pablo Neira Ayuso <pablo@netfilter.org> This patch adds the support for the DCCP sequence number tracking that is included in the upcoming Linux kernel 2.6.31. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* bsf: add support for IPv6 address filteringPablo Neira Ayuso2009-07-141-0/+6
| | | | | | | | | | | | This patch adds support to auto-generate BSF code for IPv6. It requires a Linux kernel >= 2.6.29. The maximum number of addresses is limited to 20 (12 BSF lines per IPv6 address comparison). I am not sure that to remove this limit is useful given that oprofile does not show very good numbers for very large (in terms of lines) filters. This completes one feature that is available in IPv4 but that was missing in IPv6. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: recover some obsolete enums and constants not to break backwardPablo Neira Ayuso2009-06-211-0/+6
| | | | | | | | This patch partially reverts 76e6042107de23790f0532e3bf3c396cba27e5aa since it recovers some obsolete enums and constants that are required to avoid breaking compilation of old versions of the conntrack-tools. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* api: add new callback interface while keeping backward compatibilityPablo Neira Ayuso2009-05-231-0/+12
| | | | | | | | | | | This patch adds nfct_callback_register2() and nfct_callback_unregister2() that allows to register a callback function with a new callback interface that includes the Netlink message. This fixes an early design error. This is not nice but it is the only way to resolve this problem without breaking backward (I don't like function versioning, it is messy). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add DCCP role attributePablo Neira Ayuso2009-04-241-0/+1
| | | | | | | This patch adds DCCP role attribute support. This needs Linux kernel >= 2.6.30. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add initial DCCP supportPablo Neira Ayuso2009-04-141-0/+1
| | | | | | This patch adds initial DCCP support for libnetfilter_conntrack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove reminiscent of NFCT_DIR_ORIGINAL and old prototypesPablo Neira Ayuso2009-02-171-285/+0
| | | | | | | | This patch removes a reminiscent constant of the old API whose value is the same of __DIR_ORIG. This patch also removes the prototype definition from libnetfilter_conntrack.h. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* API: add nfct_attr_is_set_array functionPablo Neira Ayuso2008-10-301-0/+4
| | | | | | | This new function checks for the presence of a given set of attributes that are passed as an array. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* groups: add attribute group APIPablo Neira Ayuso2008-10-301-0/+56
| | | | | | | | | | | | This new API allows you to set and get some logical set of attributes. This is not intended to replace the existing per-attribute get/set API but to provide more efficient way to get/set certain attributes. This change includes an example file (conntrack_grp_create.c) of the use of the attribute group API. See ATTR_GRP_* for more information on the existing groups. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* helper: explicit helper assignation supportlibnetfilter_conntrack-0.0.97Pablo Neira Ayuso2008-10-131-0/+1
| | | | | | | | This patch adds support for explicit helper assignation. This support will not be of any help without the appropriate kernel support that will go into the Linux kernel 2.6.29 -sic-. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* compare: add two new flags for different level of comparisonsPablo Neira Ayuso2008-10-021-0/+2
| | | | | | | | This patch adds NFCT_CMP_MASK and NFCT_CMP_STRICT which determines the level of strictness that is applied to the comparison of two conntrack objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Extend high-level API for netlink BSF to add negative logicPablo Neira Ayuso2008-07-181-0/+10
| | | | | | | This patch introduces nfct_filter_set_logic() to set the filtering logic which results in a more flexible solution. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add berkeley socket filtering high-level APIPablo Neira Ayuso2008-07-171-0/+35
| | | | | | | | This patch adds an abstraction level to berkeley sockets filter (BSF) for Netlink sockets available since Linux kernel 2.6.26. This provides an easy way to attach filters without knowing about BSF at all. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add full support of SCTPPablo Neira Ayuso2008-05-211-0/+3
|
* improve nfct_copy/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-05-141-1/+7
|
* - bump version to 0.0.92/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-161-1/+9
| | | | | | | | - recover the ID support - add support for timeout comparison - ignore set operation for counters and use attributes - fix broken status comparison - statify several __snprintf functions
* - add nfct_cmp (replacement for nfct_compare a bit more flexible)/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-131-0/+22
| | | | | | - add nfct_copy - conditional build of original and reply tuples - fix secmark parsing
* add nfct_send/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-091-0/+4
|
* add support for NAT sequence adjusment/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-091-0/+6
|
* add NFCT_OF_TIME output flag to nfct_snprintf/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-01-131-0/+3
|
* - add support for secmark/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2007-12-171-0/+1
| | | | - fix typo s/test_but/test_bit/
* Add support for conntrack master setup/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2007-12-081-1/+9
|