conntrack: fix timestamps when microseconds are less than 100000

The fractional portion of timestamps reported by conntrack
is printed as a left-justified integer instead of fixed-width
and zero-padded.

Closes netfilter's bugzilla 817:
https://bugzilla.netfilter.org/show_bug.cgi?id=817

Reported-by: hoffman@stanford.edu
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
conntrackd: fix compiler warnings

main.c:359:6: warning: ignoring return value of 'nice' [..]
main.c:395:7: warning: ignoring return value of 'chdir' [..]
run.c:43:17: warning: declaration of 'signal' shadows a global declaration

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include: kill unused PLD_* macros

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
tests: cthelper: remove test infrastructure from this tree

I decided to move it to:

http://git.netfilter.org/conntrackd-helper-tests

to reduce the bloat of this tree, most people are not interested
in this stuff when they grab it via git clone.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
cthelper: add IPv6 support

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
cthelper: helpers may not use private information area

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
conntrack: add connlabel format attribute

Signed-off-by: Florian Westphal <fw@strlen.de>
conntrackd: cache: fix hashing based on IPv6 address

Use source and destination address, not only source address for
hashing.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
conntrackd: deprecate `Family' in configuration file

This patch deprecates the `Family' tweak in the configuration file.

Several reasons for this:

* If not specified, this was default to IPv4 only in table dumps from
  the kernel. However, non-IPv4 events were still received. This is
  inconsistent.

* It's an early tweak that was not documented (not included in any
  of the example files).

If we want to support any sort of consistent filtering based on the
family, this should happen in the filtering code.

After this patch, conntrackd uses AF_UNSPEC to dump the conntrack and
expectation tables from the kernel.

Reported-by: Bill Fink <billfink@mindspring.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
conntrackd: fix crash with IPv6 expectation in the filtering code

Jul  5 00:41:06 sen-fw1 kernel: [274422.060695] conntrackd[4821]: segfault at 0 ip 000000000040c660 sp 00007fffebb098a8 error 4 in conntrackd[400000+3d000]

> #0  0x000000000040f217 in jhash2 (k=0x0, length=4, initval=0) at ../include/jhash.h:99
>         a = 2654435769 b = 2654435769 c = 0 len = 4
> #1  0x000000000040f564 in ct_filter_hash6 (data=0x0, table=0x16ef630) at filter.c:57
> #2  0x000000000040ad34 in hashtable_hash (table=0x16ef630, data=0x0) at hash.c:63
> #3  0x000000000040fd19 in __ct_filter_test_ipv6 (f=0x16eeba0, ct=0x1703760) at filter.c:265
> id_src = 51 id_dst = 24051376 src = 0x1703760 dst = 0x0

The master conntrack of the expectation has no reply tuple. However, the
filtering routine needs it. To avoid this issue, emulate the source
address in the reply tuple.

While at it, fix incorrect sanity checking that should have caught
this issue.

Thanks to Florian Westphal for initial diagnosing of this bug.

Reported-by: Bill Fink <billfink@mindspring.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
conntrackd: simplify expectation filtering

This patch simplifies the expectation filtering by looking up for the
master conntrack. If it does not exists, then we assume that we don't
want this expectation either.

This simplification also fixes the current broken expectation filtering,
since the master conntrack from expectations has neither reply tuple
nor state, however, the filtering code assumes the opposite.

This partially reverts (479a37a conntrackd: fix crash with IPv6 expectation
in the filtering code) since it was incorrectly setting the reply tuple
of the master conntrack.

Thanks to Bill Fink for providing feedback to resolve this issue.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
conntrack: introduce -l option to filter by labels

Signed-off-by: Clemence Faure <clemence.faure@sophos.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
conntrackd: support replication of connlabels

- check if ct has label attribute, and at least one label
  (bit) is set
- serialize bitmap into array-of-u32, in network byte order
- add code to build new nfct_bitmask object from array-of-u32

Current parse functions don't have length information,
this adds optional parse2() which gets struct netattr pointer.

Attributes that want to use parse2 need to set .maxsize to nonzero
value.

Signed-off-by: Florian Westphal <fw@strlen.de>
conntrack: fix -L format output

commit d343b8c (conntrack: add connlabel format attribute) erronously
removed _UNKNOWN format, i.e. conntrack -L displayed
[UPDATE] tcp      6 114 TIME_WAIT src=..
^^^^^
Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
conntrack: fix reporting of unknown arguments

short options were always reported as "unknown argument".
getopt(3) says:

if [it] finds an option character in argv that was not included in
optstring, or if it detects a missing option argument, it returns '?'
and sets the external variable optopt to the actual option character.
If the first character [...] of  optstring  is  a  colon  (':'),
then getopt() returns ':' instead of '?' to indicate a missing option
argument.

Signed-off-by: Clemence Faure <clemence.faure@sophos.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
cthelper: fix IPv6 address and mask in newly created expectations

Set to zero the entire address if needed, not just 4 bytes.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
conntrack-tools 1.4.2 release

bump dependency with libnetfilter_conntrack to 1.0.4, otherwise
we don't get the connlabel support.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>