{"push_id":874603514,"size":27,"distinct_size":2,"ref":"refs/heads/lithium","head":"59d32a5874dc3090f58df44969332c7bcae5ba10","before":"1e0476f8157fc09c6f9ff086e7b55452b39ea48d","commits":[{"sha":"d44489648c1a56d543a84bbebe455227bb25cf34","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"conntrackd: fix compilation in src/parse.c\n\nMaking all in src\nmake[1]: Entering directory `/home/oden/RPM/BUILD/conntrack-tools-1.2.0/src'\n  CC     parse.o\nparse.c: In function 'msg2ct':\nparse.c:258:34: error: 'NULL' undeclared (first use in this function)\nparse.c:258:34: note: each undeclared identifier is reported only once for\neach function it appears in\nparse.c: In function 'msg2exp':\nparse.c:438:16: error: 'NULL' undeclared (first use in this function)\n\nReported-by: Oden Eriksson <oeriksson@mandriva.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/d44489648c1a56d543a84bbebe455227bb25cf34"},{"sha":"c88266b35ba130e804422ce2fe0da6704d620bd6","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"doc: fix documentation on ExpectationSync and H.323 helper\n\nThe H.323 helper is actually composed of three helpers:\n\nras\nq.931\nh.245\n\nWe have to specify those in the configuration file since h.323 is\nnot any known helper itself.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/c88266b35ba130e804422ce2fe0da6704d620bd6"},{"sha":"8648ae6d08bb84030c2c3519454532f6e04e31d9","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"conntrackd: add bugtrap notice in case of flush while commit in progress\n\nFlushing the external cache, ie. conntrackd -f, while commit is in progress\nis not allowed anymore, ie. conntrackd -c.\n\nNote that conntrackd -c is synchronous. Thus, it returns control to the\ncaller once the commit has finished.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/8648ae6d08bb84030c2c3519454532f6e04e31d9"},{"sha":"7eb63b5872f07903d952aa5cfd6ad0e7647a066a","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"conntrackd: fix commit operation, needs to be synchronous\n\nWhile adding the expectation support for conntrackd, I accidentally\nbroke synchrony in 'conntrackd -c' command.\n\nBasically, conntrackd -c should not return control to the shell\nuntil the cache has been committed.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/7eb63b5872f07903d952aa5cfd6ad0e7647a066a"},{"sha":"3cd88a6d9c66360dad983578259ab92ba083fca8","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"conntrackd: implement selective flushing for `-t' and `-F' commands\n\nThis patch changes the current behaviour of `-t' and `-F' commands,\nthat results in flushing the kernel conntrack table. With this patch,\nthe entries that match the Filter clauses in conntrackd.conf are\nignored.\n\nThis fixes the situation in which some local ssh connection to the\nfirewall is lost during the failover (since `-t' is invoked from the\nprimary-backup.sh script).\n\nNote that the Filter clause tells what entries have to be ignored,\nie. the entries that do not need to be replicated. It makes sense\nnot to flush entries that are not replicated (usually traffic to\nthe local firewall).\n\nReported-by: Gaurav Sinha <gaurav.sinha@vyatta.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/3cd88a6d9c66360dad983578259ab92ba083fca8"},{"sha":"bbfd467280d15c9bcd56da43bf49049ab6334e64","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"bump version to 1.2.2\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/bbfd467280d15c9bcd56da43bf49049ab6334e64"},{"sha":"9aecd75541aab51f5add2884df5105bda87fc05a","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"conntrack: add support for stats dumping via ctnetlink\n\nSince Linux kernel >= 3.6.x, we can dump the conntrack statistics\nvia ctnetlink instead of using the /proc interface:\n\n conntrack -S\n\ncpu=0           searched=9177 found=387086 new=250451 invalid=1 ignore=4 delete=254093 delete_list=5467 insert=1825 insert_failed=0 drop=0 early_drop=0 error=0 search_restart=0\ncpu=1           searched=390 found=37493 new=1531 invalid=0 ignore=0 delete=345 delete_list=345 insert=1531 insert_failed=0 drop=0 early_drop=0 error=0 search_restart=0\ncpu=2           searched=333 found=68061 new=1895 invalid=0 ignore=1 delete=607 delete_list=607 insert=1896 insert_failed=0 drop=0 early_drop=0 error=0 search_restart=0\ncpu=3           searched=71 found=13364 new=1254 invalid=0 ignore=0 delete=75 delete_list=75 insert=1254 insert_failed=0 drop=0 early_drop=0 error=0 search_restart=0\n\n conntrack -S exp\n\ncpu=0           expect_new=9177 expect_create=387284 expect_delete=251141\ncpu=1           expect_new=390 expect_create=37496 expect_delete=1531\ncpu=2           expect_new=333 expect_create=68117 expect_delete=1895\ncpu=3           expect_new=71 expect_create=13366 expect_delete=1255\n\nNote that the output is not backward-compatible, but we fail back to previous\noutput in case that ctnetlink stats dumping is not available.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/9aecd75541aab51f5add2884df5105bda87fc05a"},{"sha":"ec4c0ff33746fb2c663194f27dd41deee83f870f","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"conntrack: -C uses ctnetlink instead of /proc/sys/net/netfilter/nf_conntrack_count\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/ec4c0ff33746fb2c663194f27dd41deee83f870f"},{"sha":"c712ccebc993cad3f73000bbe9e4788ebeb95ca2","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"conntrackd: generalize file descriptor infrastructure\n\nThis patch generalizes the select-based file descriptor infrastructure\nby allowing you to register file descriptors and its callbacks. Instead\nof hardcoding the descriptors that needs to be checked.\n\nNow, struct fds_item contains a callback and pointer to data that is\npassed to it:\n\n  struct fds_item {\n         struct list_head        head;\n         int                     fd;\n +       void                    (*cb)(void *data);\n +       void                    *data;\n  };\n\nThen, we check which ones are active in the select_main_step() function:\n\n list_for_each_entry(cur, &STATE(fds)->list, head) {\n         if (FD_ISSET(cur->fd, &readfds))\n                 cur->cb(cur->data);\n }\n\nAnd it invoked the corresponding callback.\n\nI had to slightly modify the channel infrastructure to fit it into\nthe changes.\n\nThis modularity is required for the upcoming cthelper support.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/c712ccebc993cad3f73000bbe9e4788ebeb95ca2"},{"sha":"5a0d0ecf30fb1686cfb10aaa852fee9c8ed4360a","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"conntrackd: move ctnetlink code to ctnl.c (removed from run.c)\n\nThis patch moves the specific ctnetlink code to ctnl.c to prepare\nthe introduction of the cthelper infrastructure.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/5a0d0ecf30fb1686cfb10aaa852fee9c8ed4360a"},{"sha":"5e8f64f46cb1dd71b0a94cb7dad87da00b8c5e32","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"conntrackd: add cthelper infrastructure (+ example FTP helper)\n\nThis patch adds the user-space helper infrastructure. It also\ncontains the implementation of the FTP helper in user-space.\n\nThere's one example file that you can use to configure conntrackd\nas user-space connection tracking helper under:\n\n doc/helper/conntrackd.conf\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/5e8f64f46cb1dd71b0a94cb7dad87da00b8c5e32"},{"sha":"969d93f14fffadb5cae67a7662484c1e064bbff1","author":{"email":"5a7b97a838c5f3992292d1fd9e7ad830cc55ada6@blackhole.kfki.hu","name":"Jozsef Kadlecsik"},"message":"conntrackd: RPC helper added to cthelper\n\nHow to use this helper in a few steps:\n\n1) You can enable this helper via:\n\n nfct helper add rpc inet tcp\n nfct helper add rpc inet udp\n\n2) Configure /etc/conntrackd/conntrackd.conf and launch it.\n\n3) You can test this helper locally with the following rule-set:\n\n iptables -A OUTPUT -t raw -p udp -m udp --dport 111 -j CT --helper rpc\n iptables -A OUTPUT -t raw -p tcp -m tcp --dport 111 -j CT --helper rpc\n iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 111 -j ACCEPT\n iptables -A OUTPUT -p udp -m state --state NEW,ESTABLISHED -m udp --dport 111 -j ACCEPT\n iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n iptables -P OUTPUT DROP\n\n4) Configure NFS and export some local directory. Then, mount it with version 3.\n\n mount.nfs -onfsvers=3 127.0.0.1:/srv/cvs /mnt/\n\nYou should see permanent expectations created for this.\n\nSigned-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/969d93f14fffadb5cae67a7662484c1e064bbff1"},{"sha":"40f4330e6b50ed2b198549b1006c6fcb349f5a3b","author":{"email":"5a7b97a838c5f3992292d1fd9e7ad830cc55ada6@blackhole.kfki.hu","name":"Jozsef Kadlecsik"},"message":"conntrackd: TNS helper added to cthelper\n\nSigned-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/40f4330e6b50ed2b198549b1006c6fcb349f5a3b"},{"sha":"ff5eb25aa6963536e3f640c5c38c341ce02809bb","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"tests: conntrackd: add cthelper-test infrastructure\n\nThis patch adds the automated testing infrastructure the user-space\nhelpers. Basically, this adds the `cthelper-test' program that can\nbe invoked from the command line:\n\n ./cthelper-test pcaps/oracle-tns-redirect.pcap tns tcp 1521\n\nTo test the helper with one PCAP file that contains traces of Oracle TNS\ntraffic. It also provides tweaks to test the DNAT content mangling code:\n\n ./cthelper-test pcaps/oracle-tns-redirect.pcap tns tcp 1521 dnat\n\nThis will also allow fuzzy testing of user-space helper, for further\nvalidation, not yet implemented.\n\nTo compile this tool, you have to run:\n\n./configure\nmake check\n\nunder the qa/cthelper-test/ directory. I'm doing like this because\nthis directory is not included in the standalone tarball that\nmake distcheck generates (I don't want to bloat it with development\ntools that can be retrieved from the git repository).\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/ff5eb25aa6963536e3f640c5c38c341ce02809bb"},{"sha":"f9ad41077c473884f33c6677f81119614d5a8eb2","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"nfct: helper: use CONNTRACKD_LIB_DIR variable set during configuration\n\nInstead of hardcoded path to /usr/lib/conntrack-tools/ which might\nnot be true if options like --prefix with different location is\npassed to conntrack.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/f9ad41077c473884f33c6677f81119614d5a8eb2"},{"sha":"18bfa4bfb3bb875c36756272bb653c33e338c776","author":{"email":"d17182a6d913b2bb62f604778fe6a6923d3093f5@luffy.cx","name":"Vincent Bernat"},"message":"conntrackd: don't resync expectations if such sync has been disabled\n\nconntrackd was segfaulting with `ExpectationSync` set to `Off`\nand PollSecs (polling mode) in use.\n\nSigned-off-by: Vincent Bernat <bernat@luffy.cx>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/18bfa4bfb3bb875c36756272bb653c33e338c776"},{"sha":"3733cabc2640d00a0fc3aee2d37d1bb9d097fc0f","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"cthelper: disable debugging information by default\n\nThe pr_debug call should be converted to use dlog instead.\n\nI'll try to add some some configuration parameter to\nenable/disable debugging in runtime. This is not very flexible.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/3733cabc2640d00a0fc3aee2d37d1bb9d097fc0f"},{"sha":"137b0a2ac9568638be078126ca92ac62ca51e1f4","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"cthelper: ftp: fix EPRT case for IPv4\n\n%pI4 also exists in the Linux kernel.\n\nIt would be good to have some generic functions to convert binary data\nto address string. Later.\n\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/137b0a2ac9568638be078126ca92ac62ca51e1f4"},{"sha":"c9698ed05f450f9c32b8c1342c42b584988102de","author":{"email":"df3f3586a099c8d42467783abe231c1cf7731ae6@nicira.com","name":"Ansis Atteka"},"message":"tests: conntrackd: fix compile errors and warnings\n\nThis patch fixes few compile warnings and errors.\n\nSigned-off-by: Ansis Atteka <aatteka@nicira.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/c9698ed05f450f9c32b8c1342c42b584988102de"},{"sha":"46faeab56cf4117f41cb6f1f1c40a9c18a81372f","author":{"email":"707d14912bb250caf67dfe0ea4035681fbfc4f56@netfilter.org","name":"Pablo Neira Ayuso"},"message":"conntrackd: parse: fix wrong maximum length for ATTR_EXP_FN\n\nIt was set to NFCT_HELPER_NAME_MAX (16 bytes), but we have function\nnames that are larger, eg. nf-nat-follow-master which is 18 bytes\nlong.\n\nThis leads to hitting malformed message while synchronizing\nexpectations.\n\nI'll add some new constant to libnetfilter_conntrack instead of\nhardcoding this, later.\n\nReported-by: Gaurav Sinha <gaurav.sinha@vyatta.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":false,"url":"https://api.github.com/repos/cyclops8456/conntrack-tools/commits/46faeab56cf4117f41cb6f1f1c40a9c18a81372f"}]}