* [PATCH 1/2] conntrack-tools: Update to version 1.4.7
@ 2022-11-18 22:50 Adolf Belka
2022-11-18 22:50 ` [PATCH 2/2] libnetfilter_conntrack: Update to version 1.0.9 Adolf Belka
2022-11-19 11:52 ` [PATCH 1/2] conntrack-tools: Update to version 1.4.7 Michael Tremer
0 siblings, 2 replies; 4+ messages in thread
From: Adolf Belka @ 2022-11-18 22:50 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 3109 bytes --]
- Update from 1.4.6 to 1.4.7
- Update of rootfile not required
- Requires update fo libnetfilter_conntrack from 1.0.8 to 1.0.9
- Changelog
conntrack-tools 1.4.7
This release contains new features:
* IPS_HW_OFFLOAD flag specifies that a conntrack entry has been
offloaded into the hardware
* 'clash_resolve' and 'chaintoolong' stats counters
* Default to unspec family if '-f' flag is absent to improve support for
dual-stack setups
* Support filtering events by IP address family
* Support flushing per IP address family
* Add "save" output format representing data in conntrack parameters
* Support loading conntrack commands from a batch file, e.g. generated
by "save" output format
* Annotate portid in events by the program name (if found)
* Accept yes/no as synonyms to on/off in conntrackd.conf
* Support user space helper auto-loading upon daemon startup, relieving
users from manual 'nfct add helper' calls
* Filter dumps by status on kernel side if possible
* Accept to filter for any status other than SEEN_REPLY using
'UNREPLIED'
* Use libmnl internally
* Reuse netlink socket for improved performance with bulk CT entry loads
* Remove '-o userspace' flag and always tag user space triggered events
* Introduce '-A' command, a variant of '-I' which does not fail if the
entry exists already
... and fixes:
* ICMP entry creation would fail when reply data was specified
* Sync zone value also
* Log external inject problems as warning only
* Endianness bug parsing IP addresses
* Ignore conntrack ID when looking up cache entries to allow for stuck
old ones to be replaced eventually
* Broken parsing of IPv6 M-SEARCH requests in ssdp cthelper
* Eliminate the need for lazy binding in nfct
* Fix for use of unknown protocol values
* Sanitize protocol value parsing, catch illegal values
* Ensure unknown protocol values are included in '-o save' dumps
... and documentation updates:
* Fixed examples in manual
* Refer to nf_conntrack sysctl instead of the deprecated ip_conntrack
one
* Misc updates to the manual
* Add an older example script creating an active-active setup using the
cluster match
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
lfs/conntrack-tools | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lfs/conntrack-tools b/lfs/conntrack-tools
index 7bfd71d89..2296c7ca8 100644
--- a/lfs/conntrack-tools
+++ b/lfs/conntrack-tools
@@ -24,7 +24,7 @@
include Config
-VER = 1.4.6
+VER = 1.4.7
THISAPP = conntrack-tools-$(VER)
DL_FILE = $(THISAPP).tar.bz2
@@ -42,7 +42,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 7c1ee1c5fc2b6f9d33c6cf850eca80978b8763317b1a76892cefb776130564f15fbd4e4554fdb08dbba93d9f16b7e4624a1b4dd5a631f747f5fcc0a5b01b8d5e
+$(DL_FILE)_BLAKE2 = 42a3cacf8a32a5b8b688a9fd68f66024c591e9814ef3cc349456691094bab0fae15bb1c00befa178b0f8e845bf6fc00715cbf9db55cd7bf2d155c2dfd55f9b1a
install : $(TARGET)
--
2.38.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 2/2] libnetfilter_conntrack: Update to version 1.0.9
2022-11-18 22:50 [PATCH 1/2] conntrack-tools: Update to version 1.4.7 Adolf Belka
@ 2022-11-18 22:50 ` Adolf Belka
2022-11-19 11:51 ` Michael Tremer
2022-11-19 11:52 ` [PATCH 1/2] conntrack-tools: Update to version 1.4.7 Michael Tremer
1 sibling, 1 reply; 4+ messages in thread
From: Adolf Belka @ 2022-11-18 22:50 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 4244 bytes --]
- Update from version 1.0.8 to 1.0.9
- Update of rootfile
- Changelog
1.0.9
This release comes with the new nfct_nlmsg_build_filter() function that
allows to add metadata for kernel-side filtering of conntrack entries
during conntrack table dump.
The nfct_query() API supports the new NFCT_Q_FLUSH_FILTER argument,
it allows to flush only ipv4 or ipv6 entries from the connection
tracking table.
nfct_snprint family of functions have been updated.
SCTP conntrack entries now support 'heartbeat sent/acked' state.
Entries offloaded to hardware include '[HW_OFFLOAD]' in the formatted
output string.
Notable bugs fixed with this release include:
Fix buffer overflows and out-of-bounds accesses in the
nfct_snprintf() functions.
nfct_nlmsg_build() did not work for ICMP flows unless all ICMP attributes
were set in the reply tuple too, this affected the 'conntrack' tool
where updates (e.g. setting the conntrack mark to a different value)
of ICMP flows would not work.
- Detailed Changes
src: Handle negative snprintf return values properly
src: Fix nfexp_snprintf return value docs
conntrack: Replace strncpy with snprintf to improve null byte handling
conntrack: Fix incorrect snprintf size calculation
include: Add ARRAY_SIZE() macro
conntrack: Fix buffer overflow on invalid icmp type in setters
conntrack: Move icmp request>reply type mapping to common file
conntrack: Fix buffer overflow in protocol related snprintf functions
conntrack: Fix buffer overflows in __snprintf_protoinfo* like in *2str fns
examples: check return value of nfct_nlmsg_build()
libnetfilter_conntrack.pc.in: add LIBMNL_LIBS to Libs.Private
conntrack: dccp print function should use dccp state
conntrack: sctp: update states
include: add CTA_STATS_CLASH_RESOLVE
include: sync uapi header with nf-next
src: add support for status dump filter
include: add CTA_STATS_CHAIN_TOOLONG from linux 5.15 uapi
libnetfilter_conntrack: bump version to 1.0.9
build: use the right automake variables
Update .gitignore
build: update obsolete autoconf macros
conntrack: fix invmap_icmpv6 entries
conntrack: Don't use ICMP attrs in decision to build repl tuple
src: add IPS_HW_OFFLOAD flag
conntrack: add flush filter command
build: missing internal/proto.h in Makefile.am
conntrack: add nfct_nlmsg_build_filter() helper
conntrack: don't cancel nest on unknown layer 4 protocols
tests: Fix for missing qa-connlabel.conf in tarball
tests: Add simple tests to TESTS variable
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
config/rootfiles/common/libnetfilter_conntrack | 2 +-
lfs/libnetfilter_conntrack | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/config/rootfiles/common/libnetfilter_conntrack b/config/rootfiles/common/libnetfilter_conntrack
index f5c776359..755ca8f2f 100644
--- a/config/rootfiles/common/libnetfilter_conntrack
+++ b/config/rootfiles/common/libnetfilter_conntrack
@@ -12,5 +12,5 @@
#usr/lib/libnetfilter_conntrack.la
#usr/lib/libnetfilter_conntrack.so
usr/lib/libnetfilter_conntrack.so.3
-usr/lib/libnetfilter_conntrack.so.3.7.0
+usr/lib/libnetfilter_conntrack.so.3.8.0
#usr/lib/pkgconfig/libnetfilter_conntrack.pc
diff --git a/lfs/libnetfilter_conntrack b/lfs/libnetfilter_conntrack
index 2eb00fb6f..3141606fe 100644
--- a/lfs/libnetfilter_conntrack
+++ b/lfs/libnetfilter_conntrack
@@ -24,7 +24,7 @@
include Config
-VER = 1.0.8
+VER = 1.0.9
THISAPP = libnetfilter_conntrack-$(VER)
DL_FILE = $(THISAPP).tar.bz2
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 614f8d80863d6f7d8110b5faf68debe3a9ba0c6737f02fa0de9d0e53d30771581becb052e7cd990b0632e9264cb9cdeb2af26a41e2b1ab9421218ec616e1f8d8
+$(DL_FILE)_BLAKE2 = 701393338a0bf852b97d80a1e4ab078dea741f7181246b3dafcbe8cff287b5b9fae72c1c50867ea71baab83fa842471b2c7054fb4702bf35900a352078de8f3a
install : $(TARGET)
--
2.38.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 2/2] libnetfilter_conntrack: Update to version 1.0.9
2022-11-18 22:50 ` [PATCH 2/2] libnetfilter_conntrack: Update to version 1.0.9 Adolf Belka
@ 2022-11-19 11:51 ` Michael Tremer
0 siblings, 0 replies; 4+ messages in thread
From: Michael Tremer @ 2022-11-19 11:51 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 4462 bytes --]
Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>
> On 18 Nov 2022, at 22:50, Adolf Belka <adolf.belka(a)ipfire.org> wrote:
>
> - Update from version 1.0.8 to 1.0.9
> - Update of rootfile
> - Changelog
> 1.0.9
> This release comes with the new nfct_nlmsg_build_filter() function that
> allows to add metadata for kernel-side filtering of conntrack entries
> during conntrack table dump.
> The nfct_query() API supports the new NFCT_Q_FLUSH_FILTER argument,
> it allows to flush only ipv4 or ipv6 entries from the connection
> tracking table.
> nfct_snprint family of functions have been updated.
> SCTP conntrack entries now support 'heartbeat sent/acked' state.
> Entries offloaded to hardware include '[HW_OFFLOAD]' in the formatted
> output string.
> Notable bugs fixed with this release include:
> Fix buffer overflows and out-of-bounds accesses in the
> nfct_snprintf() functions.
> nfct_nlmsg_build() did not work for ICMP flows unless all ICMP attributes
> were set in the reply tuple too, this affected the 'conntrack' tool
> where updates (e.g. setting the conntrack mark to a different value)
> of ICMP flows would not work.
> - Detailed Changes
> src: Handle negative snprintf return values properly
> src: Fix nfexp_snprintf return value docs
> conntrack: Replace strncpy with snprintf to improve null byte handling
> conntrack: Fix incorrect snprintf size calculation
> include: Add ARRAY_SIZE() macro
> conntrack: Fix buffer overflow on invalid icmp type in setters
> conntrack: Move icmp request>reply type mapping to common file
> conntrack: Fix buffer overflow in protocol related snprintf functions
> conntrack: Fix buffer overflows in __snprintf_protoinfo* like in *2str fns
> examples: check return value of nfct_nlmsg_build()
> libnetfilter_conntrack.pc.in: add LIBMNL_LIBS to Libs.Private
> conntrack: dccp print function should use dccp state
> conntrack: sctp: update states
> include: add CTA_STATS_CLASH_RESOLVE
> include: sync uapi header with nf-next
> src: add support for status dump filter
> include: add CTA_STATS_CHAIN_TOOLONG from linux 5.15 uapi
> libnetfilter_conntrack: bump version to 1.0.9
> build: use the right automake variables
> Update .gitignore
> build: update obsolete autoconf macros
> conntrack: fix invmap_icmpv6 entries
> conntrack: Don't use ICMP attrs in decision to build repl tuple
> src: add IPS_HW_OFFLOAD flag
> conntrack: add flush filter command
> build: missing internal/proto.h in Makefile.am
> conntrack: add nfct_nlmsg_build_filter() helper
> conntrack: don't cancel nest on unknown layer 4 protocols
> tests: Fix for missing qa-connlabel.conf in tarball
> tests: Add simple tests to TESTS variable
>
> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
> ---
> config/rootfiles/common/libnetfilter_conntrack | 2 +-
> lfs/libnetfilter_conntrack | 4 ++--
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/config/rootfiles/common/libnetfilter_conntrack b/config/rootfiles/common/libnetfilter_conntrack
> index f5c776359..755ca8f2f 100644
> --- a/config/rootfiles/common/libnetfilter_conntrack
> +++ b/config/rootfiles/common/libnetfilter_conntrack
> @@ -12,5 +12,5 @@
> #usr/lib/libnetfilter_conntrack.la
> #usr/lib/libnetfilter_conntrack.so
> usr/lib/libnetfilter_conntrack.so.3
> -usr/lib/libnetfilter_conntrack.so.3.7.0
> +usr/lib/libnetfilter_conntrack.so.3.8.0
> #usr/lib/pkgconfig/libnetfilter_conntrack.pc
> diff --git a/lfs/libnetfilter_conntrack b/lfs/libnetfilter_conntrack
> index 2eb00fb6f..3141606fe 100644
> --- a/lfs/libnetfilter_conntrack
> +++ b/lfs/libnetfilter_conntrack
> @@ -24,7 +24,7 @@
>
> include Config
>
> -VER = 1.0.8
> +VER = 1.0.9
>
> THISAPP = libnetfilter_conntrack-$(VER)
> DL_FILE = $(THISAPP).tar.bz2
> @@ -40,7 +40,7 @@ objects = $(DL_FILE)
>
> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
>
> -$(DL_FILE)_BLAKE2 = 614f8d80863d6f7d8110b5faf68debe3a9ba0c6737f02fa0de9d0e53d30771581becb052e7cd990b0632e9264cb9cdeb2af26a41e2b1ab9421218ec616e1f8d8
> +$(DL_FILE)_BLAKE2 = 701393338a0bf852b97d80a1e4ab078dea741f7181246b3dafcbe8cff287b5b9fae72c1c50867ea71baab83fa842471b2c7054fb4702bf35900a352078de8f3a
>
> install : $(TARGET)
>
> --
> 2.38.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 1/2] conntrack-tools: Update to version 1.4.7
2022-11-18 22:50 [PATCH 1/2] conntrack-tools: Update to version 1.4.7 Adolf Belka
2022-11-18 22:50 ` [PATCH 2/2] libnetfilter_conntrack: Update to version 1.0.9 Adolf Belka
@ 2022-11-19 11:52 ` Michael Tremer
1 sibling, 0 replies; 4+ messages in thread
From: Michael Tremer @ 2022-11-19 11:52 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 3341 bytes --]
Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>
> On 18 Nov 2022, at 22:50, Adolf Belka <adolf.belka(a)ipfire.org> wrote:
>
> - Update from 1.4.6 to 1.4.7
> - Update of rootfile not required
> - Requires update fo libnetfilter_conntrack from 1.0.8 to 1.0.9
> - Changelog
> conntrack-tools 1.4.7
> This release contains new features:
> * IPS_HW_OFFLOAD flag specifies that a conntrack entry has been
> offloaded into the hardware
> * 'clash_resolve' and 'chaintoolong' stats counters
> * Default to unspec family if '-f' flag is absent to improve support for
> dual-stack setups
> * Support filtering events by IP address family
> * Support flushing per IP address family
> * Add "save" output format representing data in conntrack parameters
> * Support loading conntrack commands from a batch file, e.g. generated
> by "save" output format
> * Annotate portid in events by the program name (if found)
> * Accept yes/no as synonyms to on/off in conntrackd.conf
> * Support user space helper auto-loading upon daemon startup, relieving
> users from manual 'nfct add helper' calls
> * Filter dumps by status on kernel side if possible
> * Accept to filter for any status other than SEEN_REPLY using
> 'UNREPLIED'
> * Use libmnl internally
> * Reuse netlink socket for improved performance with bulk CT entry loads
> * Remove '-o userspace' flag and always tag user space triggered events
> * Introduce '-A' command, a variant of '-I' which does not fail if the
> entry exists already
> ... and fixes:
> * ICMP entry creation would fail when reply data was specified
> * Sync zone value also
> * Log external inject problems as warning only
> * Endianness bug parsing IP addresses
> * Ignore conntrack ID when looking up cache entries to allow for stuck
> old ones to be replaced eventually
> * Broken parsing of IPv6 M-SEARCH requests in ssdp cthelper
> * Eliminate the need for lazy binding in nfct
> * Fix for use of unknown protocol values
> * Sanitize protocol value parsing, catch illegal values
> * Ensure unknown protocol values are included in '-o save' dumps
> ... and documentation updates:
> * Fixed examples in manual
> * Refer to nf_conntrack sysctl instead of the deprecated ip_conntrack
> one
> * Misc updates to the manual
> * Add an older example script creating an active-active setup using the
> cluster match
>
> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
> ---
> lfs/conntrack-tools | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/lfs/conntrack-tools b/lfs/conntrack-tools
> index 7bfd71d89..2296c7ca8 100644
> --- a/lfs/conntrack-tools
> +++ b/lfs/conntrack-tools
> @@ -24,7 +24,7 @@
>
> include Config
>
> -VER = 1.4.6
> +VER = 1.4.7
>
> THISAPP = conntrack-tools-$(VER)
> DL_FILE = $(THISAPP).tar.bz2
> @@ -42,7 +42,7 @@ objects = $(DL_FILE)
>
> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
>
> -$(DL_FILE)_BLAKE2 = 7c1ee1c5fc2b6f9d33c6cf850eca80978b8763317b1a76892cefb776130564f15fbd4e4554fdb08dbba93d9f16b7e4624a1b4dd5a631f747f5fcc0a5b01b8d5e
> +$(DL_FILE)_BLAKE2 = 42a3cacf8a32a5b8b688a9fd68f66024c591e9814ef3cc349456691094bab0fae15bb1c00befa178b0f8e845bf6fc00715cbf9db55cd7bf2d155c2dfd55f9b1a
>
> install : $(TARGET)
>
> --
> 2.38.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-11-19 11:52 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-18 22:50 [PATCH 1/2] conntrack-tools: Update to version 1.4.7 Adolf Belka
2022-11-18 22:50 ` [PATCH 2/2] libnetfilter_conntrack: Update to version 1.0.9 Adolf Belka
2022-11-19 11:51 ` Michael Tremer
2022-11-19 11:52 ` [PATCH 1/2] conntrack-tools: Update to version 1.4.7 Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox