conntrack-tools branch, expect/vyatta, updated. conntrack-tools-1.0.0-14-gc331f3e

Pablo Neira Ayuso netfilter-cvslog-bounces at lists.netfilter.org
Wed Nov 16 02:13:26 CET 2011


This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "conntrack-tools".

The branch, expect/vyatta has been updated
  discards  8d4298bc09b1c07e1a20149c2e4ebd0bbd197d9d (commit)
  discards  8ebaa0ccce1f418d128cd4c18c15a977a665da9d (commit)
       via  c331f3ecd5c229a4211ef1632730afe435df63d7 (commit)
       via  fd6a0bc66cad09188b3c6c0d896f01a028677db0 (commit)
       via  32e9a9ea7eec097285b13330f24e002b91695b17 (commit)

This update added new revisions after undoing existing revisions.  That is
to say, the old revision is not a strict subset of the new revision.  This
situation occurs when you --force push a change and generate a repository
containing something like this:

 * -- * -- B -- O -- O -- O (8d4298bc09b1c07e1a20149c2e4ebd0bbd197d9d)
            \
             N -- N -- N (c331f3ecd5c229a4211ef1632730afe435df63d7)

When this happens we assume that you've already had alert emails for all
of the O revisions, and so we here report only the revisions in the N
branch from the common base, B.

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c331f3ecd5c229a4211ef1632730afe435df63d7
Author: Pablo Neira Ayuso <pablo at netfilter.org>
Date:   Thu Oct 27 13:01:40 2011 +0200

    conntrackd: support for expectation synchronization (incomplete!)
    
    This patch adds support to synchronize expectations between
    firewalls. However, you cannot commit them into the kernel yet.
    
    (term-1) user at client$ sudo modprobe nf_conntrack_ftp
    (term-1) user at client$ nc ftp.debian.org 21
    USER anonymous
    PASS
    PASV
    
    (Now switch to fw-1)
    
    root at fw1# conntrackd -i exp
    proto=6 src=192.168.0.2 dst=192.168.1.2 sport=0 dport=34425 [active since 9s]
    
    (Now switch to fw-2)
    
    root at fw2# conntrackd -e exp
    proto=6 src=192.168.0.2 dst=192.168.1.2 sport=0 dport=34425 [active since 5s]
    
    You have to enable the expectation support in the configuration
    file with the following option:
    
    Sync {
    	...
    	Options {
    		ExpectationSync On
    	}
    }
    
    Still needs to be implemented (it's on my TODO list):
    
    - Initial dump of the expect table.
    - Commit operation for expectations.
    - The direct injection support for expectations.
    - Flush operation for expectations.
    - User-space filtering for expectations.
    
    You'll have to get a fresh working copy of libnetfilter_conntrack,
    otherwise you'll hit one assertion in nfct_cmp().
    
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

commit fd6a0bc66cad09188b3c6c0d896f01a028677db0
Author: Pablo Neira Ayuso <pablo at netfilter.org>
Date:   Wed Nov 16 02:10:31 2011 +0100

    conntrackd: remove cache_data_get_object and replace by direct pointer
    
    We now include one pointer to the object in the extra section.
    This is required to generalize this code for the expectation
    support. We consume 4-8 bytes extra, but we will not need more
    changes to support expectations which is a good idea.

commit 32e9a9ea7eec097285b13330f24e002b91695b17
Author: Pablo Neira Ayuso <pablo at netfilter.org>
Date:   Mon Nov 14 22:48:22 2011 +0100

    conntrackd: simplify cache_get_extra function
    
    This patch simplifies cache_get_extra which now takes only one
    parameter that is the cache_object. With it, the extra area can be
    calculated.

-----------------------------------------------------------------------

Summary of changes:
 src/sync-notrack.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)


hooks/post-receive
-- 
conntrack-tools



More information about the netfilter-cvslog mailing list