From patchwork Fri Nov 18 22:50:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 6135 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4NDX7q4sKqz3wgd for ; Fri, 18 Nov 2022 22:51:03 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4NDX7n1z4yz2mv; Fri, 18 Nov 2022 22:51:01 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4NDX7n13Mhz2xqt; Fri, 18 Nov 2022 22:51:01 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4NDX7l1nJ8z2xKv for ; Fri, 18 Nov 2022 22:50:59 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4NDX7k3FWkz19J; Fri, 18 Nov 2022 22:50:58 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1668811858; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=XEpkh+yZjwApov/be9bZV4HMRpKTC8m+3W/nLLzBVAc=; b=JPBOJZ1mncXZKfJ8RpNWZFNSHZiILxhwb32YaUQdIT+XPNlHtaqTyIh2d5Pvm3kTYv3GgE z9kuXvk4dsiPTaBA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1668811858; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=XEpkh+yZjwApov/be9bZV4HMRpKTC8m+3W/nLLzBVAc=; b=snscSyXd/fvY5qfiHwNjYpIzLDhnxynwhLaB6G4mvEfHmEDwN/TZEDJuKG1qmbi1gKgaWy zSZNpre+PZcjN0/HqP4os5FEylKmjjdO6aHw3F1YuXyBnZZR8pA8vnGytCNv8sW405unUp 3A5tfE+tgAH85zKmtDTLwnQCMjzEwzWxl2C7WfVwq2upZHWrNlJFZWRjE/7xtVuDECD9h8 lH6ilEC6/sOIb2Z10OuDV90e+DGRt79B2955uSeikdp+CDXacnudVDIZ5PK2LPtYjXMlnS Z33YoFbvuQ1EqA2FL2eQvO/67PiFgvsXHMCrkYCdbGxTJI/xUQcuTcUVUSOlNA== From: Adolf Belka To: development@lists.ipfire.org Subject: [PATCH 1/2] conntrack-tools: Update to version 1.4.7 Date: Fri, 18 Nov 2022 23:50:42 +0100 Message-Id: <20221118225043.1361845-1-adolf.belka@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" - Update from 1.4.6 to 1.4.7 - Update of rootfile not required - Requires update fo libnetfilter_conntrack from 1.0.8 to 1.0.9 - Changelog conntrack-tools 1.4.7 This release contains new features: * IPS_HW_OFFLOAD flag specifies that a conntrack entry has been offloaded into the hardware * 'clash_resolve' and 'chaintoolong' stats counters * Default to unspec family if '-f' flag is absent to improve support for dual-stack setups * Support filtering events by IP address family * Support flushing per IP address family * Add "save" output format representing data in conntrack parameters * Support loading conntrack commands from a batch file, e.g. generated by "save" output format * Annotate portid in events by the program name (if found) * Accept yes/no as synonyms to on/off in conntrackd.conf * Support user space helper auto-loading upon daemon startup, relieving users from manual 'nfct add helper' calls * Filter dumps by status on kernel side if possible * Accept to filter for any status other than SEEN_REPLY using 'UNREPLIED' * Use libmnl internally * Reuse netlink socket for improved performance with bulk CT entry loads * Remove '-o userspace' flag and always tag user space triggered events * Introduce '-A' command, a variant of '-I' which does not fail if the entry exists already ... and fixes: * ICMP entry creation would fail when reply data was specified * Sync zone value also * Log external inject problems as warning only * Endianness bug parsing IP addresses * Ignore conntrack ID when looking up cache entries to allow for stuck old ones to be replaced eventually * Broken parsing of IPv6 M-SEARCH requests in ssdp cthelper * Eliminate the need for lazy binding in nfct * Fix for use of unknown protocol values * Sanitize protocol value parsing, catch illegal values * Ensure unknown protocol values are included in '-o save' dumps ... and documentation updates: * Fixed examples in manual * Refer to nf_conntrack sysctl instead of the deprecated ip_conntrack one * Misc updates to the manual * Add an older example script creating an active-active setup using the cluster match Signed-off-by: Adolf Belka Reviewed-by: Michael Tremer --- lfs/conntrack-tools | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/conntrack-tools b/lfs/conntrack-tools index 7bfd71d89..2296c7ca8 100644 --- a/lfs/conntrack-tools +++ b/lfs/conntrack-tools @@ -24,7 +24,7 @@ include Config -VER = 1.4.6 +VER = 1.4.7 THISAPP = conntrack-tools-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 7c1ee1c5fc2b6f9d33c6cf850eca80978b8763317b1a76892cefb776130564f15fbd4e4554fdb08dbba93d9f16b7e4624a1b4dd5a631f747f5fcc0a5b01b8d5e +$(DL_FILE)_BLAKE2 = 42a3cacf8a32a5b8b688a9fd68f66024c591e9814ef3cc349456691094bab0fae15bb1c00befa178b0f8e845bf6fc00715cbf9db55cd7bf2d155c2dfd55f9b1a install : $(TARGET) From patchwork Fri Nov 18 22:50:43 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 6136 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4NDX7r2ZpWz3wgq for ; Fri, 18 Nov 2022 22:51:04 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4NDX7n6QDzz2qD; Fri, 18 Nov 2022 22:51:01 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4NDX7n1l2lz2yxF; Fri, 18 Nov 2022 22:51:01 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4NDX7l66j3z2xKv for ; Fri, 18 Nov 2022 22:50:59 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4NDX7l1RH4z2mv; Fri, 18 Nov 2022 22:50:59 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1668811859; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FkraaxhTki5QDSCdIn8ujd8YmVdoIrixcxi96urj7Pc=; b=pBJos4GPBTnhqUmbyNpgEVZQnK1PEi5SVyiPruYWXD9dUijJPE/L351seEUlE81xb0LM7N EnqFokKqhGeDwyCw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1668811859; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FkraaxhTki5QDSCdIn8ujd8YmVdoIrixcxi96urj7Pc=; b=fgwXp2lLAJPD0jLdZbnTDx64iK6BbaG9EpMdOmWDDNVW8yh6c5MzYlhSl4yIIa/ylwmS5j x5kVRIVMqAQe7Az9Bb+nBz/u7kLRF3S2rTVyK/DcTjrxTe3Ejmfwq2M0YIoMrUlPH1mneK mAIF1fr+CDXk8uqMATEbynBqHCZNixHGEuosWzJB5oVtABwPNasOBJI5EUno/YA2+5aHjw /YV2VWw43QkGgX9V7jgFe+ausIBW72iPXwLQIqRdV3PZsyPTIKJp8ralyVJGJ10v7emXBB uisASGTWGfTE4XtQePAZSwzkt1d9C1KT9YODGqaFKax2vYf8P5Ad9Cq4+TMMkA== From: Adolf Belka To: development@lists.ipfire.org Subject: [PATCH 2/2] libnetfilter_conntrack: Update to version 1.0.9 Date: Fri, 18 Nov 2022 23:50:43 +0100 Message-Id: <20221118225043.1361845-2-adolf.belka@ipfire.org> In-Reply-To: <20221118225043.1361845-1-adolf.belka@ipfire.org> References: <20221118225043.1361845-1-adolf.belka@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" - Update from version 1.0.8 to 1.0.9 - Update of rootfile - Changelog 1.0.9 This release comes with the new nfct_nlmsg_build_filter() function that allows to add metadata for kernel-side filtering of conntrack entries during conntrack table dump. The nfct_query() API supports the new NFCT_Q_FLUSH_FILTER argument, it allows to flush only ipv4 or ipv6 entries from the connection tracking table. nfct_snprint family of functions have been updated. SCTP conntrack entries now support 'heartbeat sent/acked' state. Entries offloaded to hardware include '[HW_OFFLOAD]' in the formatted output string. Notable bugs fixed with this release include: Fix buffer overflows and out-of-bounds accesses in the nfct_snprintf() functions. nfct_nlmsg_build() did not work for ICMP flows unless all ICMP attributes were set in the reply tuple too, this affected the 'conntrack' tool where updates (e.g. setting the conntrack mark to a different value) of ICMP flows would not work. - Detailed Changes src: Handle negative snprintf return values properly src: Fix nfexp_snprintf return value docs conntrack: Replace strncpy with snprintf to improve null byte handling conntrack: Fix incorrect snprintf size calculation include: Add ARRAY_SIZE() macro conntrack: Fix buffer overflow on invalid icmp type in setters conntrack: Move icmp request>reply type mapping to common file conntrack: Fix buffer overflow in protocol related snprintf functions conntrack: Fix buffer overflows in __snprintf_protoinfo* like in *2str fns examples: check return value of nfct_nlmsg_build() libnetfilter_conntrack.pc.in: add LIBMNL_LIBS to Libs.Private conntrack: dccp print function should use dccp state conntrack: sctp: update states include: add CTA_STATS_CLASH_RESOLVE include: sync uapi header with nf-next src: add support for status dump filter include: add CTA_STATS_CHAIN_TOOLONG from linux 5.15 uapi libnetfilter_conntrack: bump version to 1.0.9 build: use the right automake variables Update .gitignore build: update obsolete autoconf macros conntrack: fix invmap_icmpv6 entries conntrack: Don't use ICMP attrs in decision to build repl tuple src: add IPS_HW_OFFLOAD flag conntrack: add flush filter command build: missing internal/proto.h in Makefile.am conntrack: add nfct_nlmsg_build_filter() helper conntrack: don't cancel nest on unknown layer 4 protocols tests: Fix for missing qa-connlabel.conf in tarball tests: Add simple tests to TESTS variable Signed-off-by: Adolf Belka Reviewed-by: Michael Tremer --- config/rootfiles/common/libnetfilter_conntrack | 2 +- lfs/libnetfilter_conntrack | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/libnetfilter_conntrack b/config/rootfiles/common/libnetfilter_conntrack index f5c776359..755ca8f2f 100644 --- a/config/rootfiles/common/libnetfilter_conntrack +++ b/config/rootfiles/common/libnetfilter_conntrack @@ -12,5 +12,5 @@ #usr/lib/libnetfilter_conntrack.la #usr/lib/libnetfilter_conntrack.so usr/lib/libnetfilter_conntrack.so.3 -usr/lib/libnetfilter_conntrack.so.3.7.0 +usr/lib/libnetfilter_conntrack.so.3.8.0 #usr/lib/pkgconfig/libnetfilter_conntrack.pc diff --git a/lfs/libnetfilter_conntrack b/lfs/libnetfilter_conntrack index 2eb00fb6f..3141606fe 100644 --- a/lfs/libnetfilter_conntrack +++ b/lfs/libnetfilter_conntrack @@ -24,7 +24,7 @@ include Config -VER = 1.0.8 +VER = 1.0.9 THISAPP = libnetfilter_conntrack-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 614f8d80863d6f7d8110b5faf68debe3a9ba0c6737f02fa0de9d0e53d30771581becb052e7cd990b0632e9264cb9cdeb2af26a41e2b1ab9421218ec616e1f8d8 +$(DL_FILE)_BLAKE2 = 701393338a0bf852b97d80a1e4ab078dea741f7181246b3dafcbe8cff287b5b9fae72c1c50867ea71baab83fa842471b2c7054fb4702bf35900a352078de8f3a install : $(TARGET)