conntrack: minor cleanup

Rename get_table to generic "optional argument handling" helper,
so it can be re-used in upcoming patch.

While at it, avoid copy&paste of "labelmap" handling.

Signed-off-by: Florian Westphal <fw@strlen.de>
conntrack: support multiple -l options

Using -l foo -l bar caused the "foo" label to be lost.
Merge multiple -l options so "-l foo,bar" and "-l foo -l bar" have same
effect.

Signed-off-by: Florian Westphal <fw@strlen.de>
conntrack: support add/delete of conntrack labels

new options "--label-add" and "--label-delete" to alter connlabels
assigned to a connection.

Signed-off-by: Clemence Faure <clemence.faure@sophos.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
conntrack: do not exit when update returns an error

If we fail to update an entry, just try to continue with the next one
instead of exiting.

Can happen f.e. when using "conntrack -U --add-label bla", but the
conntrack entry in the kernel does not have the label extension set.

Signed-off-by: Florian Westphal <fw@strlen.de>
conntrackd: cthelper: allow to attach expectations via nfqueue

This requires the Linux kernel 3.12.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
conntrackd: helpers: add DHCPv6 helper

This patch adds support for the DHCPv6 helper.

1) nfct helper add dhcpv6 inet6 udp
2) ip6tables -I OUTPUT -t raw -p udp --sport 546 -j CT --helper dhcpv6
3) run conntrackd

You should see:

% conntrack -L exp -f ipv6
279 proto=17 src=:: dst=ff02::1:2 sport=0 dport=546 mask-src=:: mask-dst=ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff sport=0 dport=65535 master-src=fe80::221:ccff:fe4a:7f9c master-dst=ff02::1:2 sport=546 dport=547 PERMANENT class=0 helper=dhcpv6

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nfct: modularize extensions

Modularize timeout and helper extensions.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
build: add --disable-cthelper and --disable-cttimeout

This patch allows you to disable userspace helper support and
conntrack timeout tuning at build stage.

By default, both features are enabled, to avoid breaking backward
compatibility.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nfct: timeout: use getprotoent

The kernel bails out for unsupported protocols. Moreover, we
don't need to upgrade to support new protocols.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nfct: timeout: split nfct_cmd_timeout_add in several functions

This patch is a cleanup to split this function in smaller chunks.
It is required to prepare default protocol timeout tuning via
netlink.
nfct: src: add nfct_mnl_talk and use it

Add helper function nfct_mnl_talk and use it.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
nfct: src: consolidate netlink socket creation

Open the socket from the main function, then pass it as parameter
to the corresponding interpreter.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
conntrackd: cthelper: add SANE helper

This patch adds an userspace port of the SANE helper that is currently
implemented in the kernel. This requires Linux kernel 3.12 to work.
conntrackd: cthelper: add TFTP helper

This patch adds an userspace port of the TFTP helper that is currently
implemented in the kernel. This includes NAT support. It requires a
Linux kernel 3.12.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
conntrackd: cthelper: add amanda helper

This patch adds a userspace port of the amanda helper that is
currently implemented in the kernel.

Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
nfct: Fix use-after-free / double-free

helper's list and flush commands handlers shouldn't call
mnl_socket_close on the passed netlink socket as it is done in the
main function after parse_params call.

Bug introduced in (3c78a45 nfct: src: consolidate netlink
socket creation).

Signed-off-by: Hani Benhabiles <kroosec@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
conntrackd: Don't hardcode libs dir path

Use CONNTRACKD_LIB_DIR instead of hardcoded path.

Signed-off-by: Hani Benhabiles <kroosec@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>