conntrack-tools 0.9.10 released

Hi!

The netfilter project presents another development release of the conntrack-tools. As usual, this release includes important fixes, improvements and new features, mainly:

= command line interface: conntrack =

* New option `-C': you can use it to display the number of entries in the conntrack and expectation tables.

= userspace daemon: conntrackd =

* Internal performance improvements: important rework of the hashtable/caching/queueing infrastructure; single output path for state transmissions; improved event-driven architecture. See ChangeLog attached for more details.

* Support for multi-dedicated links: you can define a pool of dedicated links, ie. if the current dedicated link fails, another available in the pool is selected to propagate state-changes. See the example files under doc/ for more information.

* Extended statistics information: you can display networking, caching, runtime and queueing statistics with `conntrackd -s [type]'. See the manpage for more information on the statistics types.

* Polling (or batch-based) synchronization: you can configure the daemon to send batches periodically instead of the soft real-time state synchronization. This allows you to set up a relaxed replication while consuming less computational resources. See `PollSecs' clause.

Q: How stable are the conntrack-tools?
A: This software is under development. Nevertheless, it has been tested in a cluster environment composed of two stateful firewalls running Debian 4.0 (Etch) with a Linux kernel 2.6.28, keepalived 1.1.15, using conntrackd in FT-FW mode, randomly (in periods of 10 seconds) setting links down to force the fail-over between the nodes. The results has shown no hangs/closure in any TCP connection.

Q: What are the conntrack-tools?
A: The conntrack-tools are:

- The userspace daemon so-called conntrackd that covers the specific aspects of stateful Linux firewalls to enable high availability solutions. It can be used as statistics collector of the firewall use as well. The daemon is highly configurable and easily extensible.

- The command line interface (CLI) conntrack that provides an interface to add, delete and update flow entries, list current active flows in plain text/XML, current IPv4 NAT'ed flows, reset counters, and flush the complete connection tracking table among many other.

Q: Where can I download it from?
A: http://www.netfilter.org/projects/conntrack-tools/downloads.html

Q: Where can I get more information about them?
A: http://conntrack-tools.netfilter.org

Q: Where can I have a look at the user manual?
A: http://conntrack-tools.netfilter.org/manual.html

On behalf of the Netfilter Project,
Pablo.

"Los honestos son inadaptados sociales" -- Les Luthiers

Pablo Neira Ayuso (48):
headers: delete unused flags in conntrackd.h
src: add network statistics via `-s network'
src: add cache statistics via `-s cache'
src: add run-time statistics via `-s runtime'
sync-mode: remove unnecessary split lines
conntrackd: fix missing \n in conntrackd -h
cache_iterators: display the commit time taken in the logs
cache_iterators: add total entries available in the cache to stats
cache: fix ENOSPC errors due to over-population of inactive entries
filter: skip filtering by state if the event has no state info
run: show current netlink buffer size in `-s runtime'
netlink: don't double the netlink buffer twice during resize
src: constify hashtable parameter in hash() callbacks
hashtable: use calloc instead of malloc + memset
hashtable: check NULL instead of ! for pointers
filter: add prefix ct_filter_ to hash and compare functions
run: limit the number of iterations over the event handling
src: rework of the hash-cache infrastructure
cache: add status field to store the object status
run: relax resynchronization algorithm when netlink overruns
sync: unify tx_list and tx_queue into one single tx_queue
ftfw: move helloing to ftfw_xmit()
sync: add generic tx_queue for all synchronization modes
sync: enqueue state updates to tx_queue
network: do not re-set the message type in nethdr_set* functions
src: support for redundant dedicated links
src: rename overrun handler to resync handler
src: remove register_fds hooks
src: add state polling support (oppossed to current event-driven)
cache: add objects statistics
ftfw: add ResendQueueSize and deprecate ResendBufferSize clauses
src: add -s queue' and change -v' behaviour
conntrack: add -C command to display the counter
src: obsolete `DestroyTimeout' clause
conntrack: fix use of -u which is optional with -I
cache_iterators: start a clean session if commit finds an entry
cache: remove nl_exist_conntrack() function
cache: mangle timeout inside nl_*_conntrack() functions
src: don't clone when calling nl_*_conntrack functions
src: change behaviour of `-t' option
cache: move lifetime feature to main cache code
src: add support for approximate timeout calculation during commit
src: increase default PurgeTimeout value
netlink: set IP_CT_TCP_FLAG_CLOSE_INIT for TIME_WAIT states
doc: unset CommitTimeout by default
doc: use 'From' instead of 'from' in the example configfiles
doc: increase hashtable bucket size and limits in example files
configure: bump version to 0.9.10

The git tag for 0.9.10 seems to be missing.

Thanks,
Jan

I forgot to add git push --tags to my release scripts, thanks for the notice.

"Los honestos son inadaptados sociales" -- Les Luthiers

I always wonder why git push --all does not push everything
(it should be true to its name, really) — such as tags o_O
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Here is a patch for the build stuff of conntrack-tools.

parent 9532b922795943b0ea24e18cc878b28b7833b92e
commit 21c7c0a7cc63d5ba6a89ed823c9b7d26d5485fcd

Author: Jan Engelhardt <[email protected]>
Date:   Mon Jan 26 00:58:40 2009 +0100

build: upgrade build system

- add .gitignore files
- replace outdated autoconf macros by new constructs, including autogen.sh
- and use AC_CONFIG_MACRO_DIR as suggested by libtool2:

libtoolize: Consider adding `AC_CONFIG_MACRO_DIR([m4])' to configure.in and
libtoolize: rerunning libtoolize, to keep the correct libtool macros in-tree.
libtoolize: Consider adding `-I m4' to ACLOCAL_AMFLAGS in Makefile.am.

---
 .gitignore     |   17 +++++++++++++++++
 Makefile.am    |    1 +
 autogen.sh     |   18 ++----------------
 configure.in   |    6 ++++--
 m4/.gitignore  |    2 ++
 src/.gitignore |    6 ++++++
 6 files changed, 32 insertions(+), 18 deletions(-)
 create mode 100644 .gitignore
 create mode 100644 m4/.gitignore
 create mode 100644 src/.gitignore

new file mode 100644
index 0000000..8676479
@@ -0,0 +1,17 @@
+.deps
+.libs
+*.la
+*.lo
+*.o
+Makefile
+Makefile.in
+
+/aclocal.m4
+/config.*
+/configure
+/depcomp
+/install-sh
+/libtool
+/ltmain.sh
+/missing
+/ylwrap

index 7383328..fde65aa 100644
@@ -2,6 +2,7 @@ include Make_global.am
 
 # not a GNU package. You can remove this line, if
 # have all needed files, that a GNU package needs
+ACLOCAL_AMFLAGS  = -I m4
 AUTOMAKE_OPTIONS = foreign dist-bzip2 1.6
 
 man_MANS = conntrack.8 conntrackd.8

index e76d3ef..36b2a2a 100755
@@ -1,18 +1,4 @@
 #!/bin/sh
 
-run ()
-{
-    echo "running: $*"
-    eval $*
-
-    if test $? != 0 ; then
-	echo "error: while running '$*'"
-	exit 1
-    fi
-}
-
-run aclocal
-run libtoolize -f
-#run autoheader
-run automake -a
-run autoconf
+autoreconf -fi;
+rm -Rf autom4te.cache;

index c430df7..cd2e7d5 100644
@@ -2,7 +2,8 @@ AC_INIT(conntrack-tools, 0.9.10, [email protected])
 
 AC_CANONICAL_SYSTEM
 
-AM_INIT_AUTOMAKE
+AC_CONFIG_MACRO_DIR([m4])
+AM_INIT_AUTOMAKE([-Wall])
 
 AC_PROG_CC
 AM_PROG_LIBTOOL

@@ -130,4 +131,5 @@ CFLAGS="$CFLAGS $LIBNETFILTER_CONNTRACK_CFLAGS"
 
 AC_SUBST(LIBNETFILTER_CONNTRACK_LIBS)
 
-AC_OUTPUT(Makefile src/Makefile include/Makefile extensions/Makefile)
+AC_CONFIG_FILES([Makefile src/Makefile include/Makefile extensions/Makefile])
+AC_OUTPUT

new file mode 100644
index 0000000..64d9bbc
@@ -0,0 +1,2 @@
+/libtool.m4
+/lt*.m4

new file mode 100644
index 0000000..6e6763d
@@ -0,0 +1,6 @@
+/conntrack
+/conntrackd
+
+/read_config_lex.c
+/read_config_yy.c
+/read_config_yy.h

Applied. Thanks Jan.

"Los honestos son inadaptados sociales" -- Les Luthiers