summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* - fix compilation warning in snprintf.c/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2007-04-243-3/+146
| | | | | | - introduce the new compare infrastructure: much simple than previous - introduce nfct_maxsize for nf_conntrack object allocated in the stack - more strict checkings in nfct_set_attr: third parameter is const
* Set status bit if whatever status flags are available, not only for ASSURED ↵/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2007-03-211-4/+1
| | | | and SEEN_REPLY
* [PATCH] Fix icmp_id setter and doc (Phil Dibowitz <phil@ipom.com>)/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=kaber/emailAddress=kaber@netfilter.org2007-03-171-1/+1
| | | | | | | | ICMP ID is stored as a u_int16_t, but its setter function derefs it's arguement as a u_int8_t. Additionally the api "doc" claims it's a u8, when it's not. This patch fixes both.
* - fix inconsistency in the behaviour of nfct_set_attr with ATTR_STATUS: now ↵/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2007-02-272-6/+10
| | | | | | status flags bits of conntrack objects in userspace can be set and unset as it happens with other attributes. - nfct_get_objopt with NAT detectors previously checks if the status attribute is set, otherwise it just skips it.
* fix wrong documentation in nfct_attr_get_u[*] functions/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2007-02-121-6/+9
|
* - fix a crash on trying to set the counters of a conntracksvn_t_libnetfilter_conntrack-0.0.50/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2007-01-052-2/+16
| | | | | | | - document that ATTR_*_COUNTER_*, ATTR_USE and ATTR_ID are unsettable - implement getter for the ATTR_USE attribute Based on patches from Victor Stinner.
* Minor fix in the counter parsing: replace htonl by ntonl, anyway they are ↵/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2006-12-292-4/+4
| | | | actually the same function so this should not break anything.
* Fix minor nitpick in the XML output (Victor Stinner)/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2006-12-291-2/+2
|
* - replace ntohs by htons in the example file (reported by Victor Stinner)/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2006-12-231-3/+0
| | | | | - introduce NFCT_O_PLAIN flag: NFCT_O_DEFAULT points to NFCT_O_PLAIN - remove commented line in nfct_new()
* Introduce the new libnetfilter_conntrack API, features:/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2006-12-1913-13/+2492
| | | | | | | | | - object oriented infrastructure - extensible and configurable output (XML) - low level functions to interact with netlink details - fairly documented Still backward compatible.
* Remove check for UID == 0, it is wrong for multiple reasons. (Sebastian ↵/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=kaber/emailAddress=kaber@netfilter.org2006-08-161-12/+0
| | | | Hagen <sebastian_hagen@memespace.net>)
* [PATCH 1/6] libnetfilter_conntrack pkt-config modifications (KOVACS ↵/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=kaber/emailAddress=kaber@netfilter.org2006-08-031-2/+2
| | | | Krisztian <hidden@balabit.hu>)
* Fix expectation mask dumping/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2006-03-011-1/+33
|
* export a function required by nfct helper support/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2006-02-091-2/+2
|
* add version info/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2006-02-091-1/+1
|
* Simplification: nfnl_send + nfnl_listen calls for nfnl_talk/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2006-02-091-18/+3
|
* flush stdout, so realtime output to a pipe is broken (Daniel De Graaf)/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2006-01-221-0/+1
|
* o Add missing layer-3 protocol flags for the expectation tuple/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2006-01-151-2/+2
| | | | o Update copyright date
* Introduce various API changes throughout the library stack/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2006-01-141-59/+109
| | | | | | | | | | | 1) make libnfnetlink dynamically allocate it's handles 2) apply that change throughout libnetfilter_* 3) add {nfq,nflog,nfct}_open_nfnl() functions that open the specific subsystem on top of an existing nfnl_handle, which is required for upcoming libnetfilter_conntrack_helper The changes break ABI and API compatibility of libnfnetlink, but don't break ABI or API compatibility of the libnetfilter_* libraries.
* o add IPv6 support/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-12-261-36/+137
| | | | | | | | | | | | o clean up layer-4 compare functions o finish the comparison infrastructure: support for tuple/mark matching o fix bug in the default event display when used in conjunction with the comparison infrastructure. o Bumped version to 0.0.30 Thanks to Yasuyuki Kozakai for: [LIBNETFILTER_CONNTRACK] fix dumping IPv6 connections that in included in this commit.
* Add support for per-family table flushing. ie. flush just AF_INET entries. ↵/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-12-191-4/+4
| | | | Towards ipv6 support.
* Slightly API changes required for the upcoming ipv6 support/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-12-191-8/+10
|
* Use u_int8_t for CTA_PROTO_NUM/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=kaber/emailAddress=kaber@netfilter.org2005-12-181-1/+1
|
* o Fixed bugs in UDP and SCTP protocol handlers (parse_proto)/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-12-031-10/+51
| | | | | | | | | o Added the comparison infrastructure for layer-4 protocols o Added libnetfilter_conntrack_[tcp|udp|icmp|sctp].h that contains the protocol flags used by the comparison infrastructure o Added nfct_conntrack_compare to compare two conntracks based on flags o Killed nfct_event_netlink_handler o nfct_event_[conntrack|expect] requires ROOT privileges (reason: netlink multicast) o Bumped version to 0.29
* - get rid of KERNELDIR include/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2005-11-141-5/+1
| | | | - have only one place where we specify the includes (Make_global.am)
* o nfct_build_conntrack is too much, the only clients are new_conntrack and svn_t_libnetfilter_conntrack-0.0.26/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-11-091-53/+67
| | | | | | | update_conntrack, and it doesn't even fit well for both cases. So I decided to kill it and inline the code adapting it when was necessary. o Convert all unsigned int/long to POSIX types u_int32_t. Better now than later :(.
* introduce library API versioning and plugin release handling/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2005-11-062-3/+9
|
* - modules don't need a 'lib' prefix/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2005-11-061-2/+2
| | | | - modules need to be linked against libnetfilter_conntrack.la, otherwise they miss a dependency
* sed 's/nfct_proto_.so/libnfct_proto_.so/g'/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-11-061-2/+2
|
* o move nfct_handler to libnetfilter_conntrack.c, better for encapsulation/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-11-061-2/+5
| | | | | | | | o fixed ICMP ID handling o fix -> libtool: link: libtool library `nfct_proto_*.la' must begin with `lib' o remove wrong flag at extensions/Makefile.am o bumped version to 0.0.26 o fixed versioning :(
* - move plugins to their own subdirectory/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2005-11-051-2/+2
| | | | - rename plugins to something that indicates their purpose (protocol)
* we have to link against libnfnetlink, otherwise the dependency is missing/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2005-11-051-1/+1
|
* add nfct_fd() function/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2005-11-041-0/+5
|
* add extra 'data' argument to callback functions/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2005-11-041-9/+19
|
* Add another missing bit concerned with the blank space in nfct_sprintf_expect_id/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-11-031-1/+2
|
* Remove last blank space returned by nfct_sprintf_expect_id/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-11-031-1/+2
|
* o Kill non-portable NIPQUAD, use inet_ntoa instead./C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-11-031-23/+45
| | | | | | | | | | | | o nfct_build_conntrack flit bits of status, timeout, id and mark. o finish incomplete support for marks: kernel part missing (patch on the way) o network byte order translation in build_conntrack instead of nfct_conntrack_alloc. Now this translation is transparent to the clients of the library. o Kill last blank space output in nfct_sprintf_[conntrack|expect] (Thanks to Krzysztof Oledzk for reporting this). o add missing initialization of buffer in nfct_default_*_display. o Bumped version to 0.2.5.
* o Bumped version to 0.2.4/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-11-011-7/+11
| | | | | | | o Redefine NFCT_ALL_CT_GROUPS o Fix typemsg2enum prototype, flags and type are 16 bits long, not 8 bits o Fix wrong expectation timeout and ID output o Fix getting and killing conntracks by ID
* o Added the expectation printing API/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-10-301-25/+53
| | | | o Bumped version to 0.2.2
* o make static protocol handler functions/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-10-301-116/+97
| | | | | | | | o move build_tuple_proto and build_protoinfo to the extensions where it really belongs to. o Reworked the conntrack and expect netlink handlers o Fix expectation table output, now it's similar to the /proc output o Bumped version to 0.2.1
* Thanks to Harald for all the comments./C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-10-291-0/+8
| | | | | | | | | | o libnetfilter_conntrack.h splitted into two parts: what is visible to application programs and what is visible to extensions. o Killed includes asm/types.h and linux/if.h o Fixed nasty wrong ipv6 definition o Stolen the status bits from ip_conntrack.h, we don't include ip_conntrack.h anymore. o move nfct_handle to libnetfilter_conntrack.c: better for encapsulation
* Fix alignment issues/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-10-281-6/+4
|
* o Renamed nfct_[set|unset]_callback to nfct_[register|unregister]_callback/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-10-281-80/+144
| | | | | | | | | | | | | | | o Added some very brief comments to libnetfilter_conntrack.h o Implemented the conntrack printers API nfct_sprintf_* o Now nfct_default_conntrack_display display the classical /proc output, and nfct_default_conntrack_display the classical + conntrack ids o Use nfnl_talk if there's no data expected from kernel space to be processed, that is the case of nfct_[get|delete]_conntrack o Added some missing memset's zeroing o Code simplification: killed some char *buf where struct nfnlhdr is enough o Killed protocol handler destructors (fini) and nfct_unregister_proto: The library is unloaded if something goes wrong (different library versions), the modules never gets inserted in the proto_list. Fixes a segfault. o Bumped version to 0.2.0
* o new nfct_handler prototype/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-10-271-109/+87
| | | | | | | | | | | o NFCT_COUNTERS splitted in NFCT_COUNTERS_[ORIG|RPLY] o all global vars are now static o kill nfct_set_handler, it was too much o fixed very stupid bug in counters printing o fixed conntrack getting: invalid netlink flags NLM_F_[ROOT|MATCH] o nfnl_send returns the proper error to the client, instead of returning -1 o some cleanup's: killed the ret, it was useless o test for the conntrack API completed, still missing the expectation test
* o Add conntrack event notification test/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-10-231-6/+15
| | | | | | o Define NFCT_ANY_GROUP flag o Now callback can return a value to stop receiving events o implement nfct_unset_callback()
* o Fix wrong list initialization of proto_list/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-10-231-1/+1
| | | | o Added a simple test case, yet incomplete
* o Bumped version to 0.1.3/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-10-211-94/+81
| | | | | | | | o Add support for ID's o Fixed stupid bug in NFCT_* flags, I'm stupid o Simplify handler logic o Define event message NFCT_MSG_* o Add support for conntrack marking (kernelspace part still missing)
* Some API changes, still some slighty modification are about to come before/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-10-211-76/+78
| | | | the first 1.0 release
* o Missing flags fro nfct_open()/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-10-201-41/+42
| | | | | o fix some indentation o fix a leak on error path in ncft_open()
* Fix the calculation of the mininum size of a message. This fix the deficit ↵/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=pablo/emailAddress=pablo@netfilter.org2005-10-161-2/+2
| | | | complain of nfnl_parse_attr.