libnetfilter_conntrack 1.0.9 release

Hi!

The Netfilter project proudly presents:

libnetfilter_conntrack 1.0.9

This release comes with the new nfct_nlmsg_build_filter() function that allows to add metadata for kernel-side filtering of conntrack entries during conntrack table dump.

The nfct_query() API supports the new NFCT_Q_FLUSH_FILTER argument, it allows to flush only ipv4 or ipv6 entries from the connection tracking table.

nfct_snprint family of functions have been updated.
SCTP conntrack entries now support 'heartbeat sent/acked' state. Entries offloaded to hardware include '[HW_OFFLOAD]' in the formatted output string.

Notable bugs fixed with this release include:
Fix buffer overflows and out-of-bounds accesses in the nfct_snprintf() functions.

nfct_nlmsg_build() did not work for ICMP flows unless all ICMP attributes were set in the reply tuple too, this affected the 'conntrack' tool where updates (e.g. setting the conntrack mark to a different value) of ICMP flows would not work.

See ChangeLog that comes attached to this email for more details.

You can download it from:

https://www.netfilter.org/projects/libnetfilter_conntrack/downloads.html

Daniel Gröber (9):
src: Handle negative snprintf return values properly
src: Fix nfexp_snprintf return value docs
conntrack: Replace strncpy with snprintf to improve null byte handling
conntrack: Fix incorrect snprintf size calculation
include: Add ARRAY_SIZE() macro
conntrack: Fix buffer overflow on invalid icmp type in setters
conntrack: Move icmp request>reply type mapping to common file
conntrack: Fix buffer overflow in protocol related snprintf functions
conntrack: Fix buffer overflows in __snprintf_protoinfo* like in *2str fns

Eyal Birger (1):
examples: check return value of nfct_nlmsg_build()

Fabrice Fontaine (1):
libnetfilter_conntrack.pc.in: add LIBMNL_LIBS to Libs.Private

Florian Westphal (7):
conntrack: dccp print function should use dccp state
conntrack: sctp: update states
include: add CTA_STATS_CLASH_RESOLVE
include: sync uapi header with nf-next
src: add support for status dump filter
include: add CTA_STATS_CHAIN_TOOLONG from linux 5.15 uapi
libnetfilter_conntrack: bump version to 1.0.9

Jan Engelhardt (2):
build: use the right automake variables
Update .gitignore

Jeremy Sowden (1):
build: update obsolete autoconf macros

Ken-ichirou MATSUZAWA (1):
conntrack: fix invmap_icmpv6 entries

Luuk Paulussen (1):
conntrack: Don't use ICMP attrs in decision to build repl tuple

Pablo Neira Ayuso (5):
src: add IPS_HW_OFFLOAD flag
conntrack: add flush filter command
build: missing internal/proto.h in Makefile.am
conntrack: add nfct_nlmsg_build_filter() helper
conntrack: don't cancel nest on unknown layer 4 protocols

Phil Sutter (2):
tests: Fix for missing qa-connlabel.conf in tarball
tests: Add simple tests to TESTS variable