From 7f1d2d6b29e9bbdc4a71adbd31d579109ce3af0d Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 7 May 2019 09:09:05 -0400 Subject: [PATCH] import conntrack-tools-1.4.4-9.el8 --- .conntrack-tools.metadata | 1 + .gitignore | 1 + ...rack-tools-1.4.4-free-pktb-after-use.patch | 29 ++ ...conntrack-tools-1.4.4-nat_tuple-leak.patch | 57 +++ SOURCES/conntrackd.conf | 419 ++++++++++++++++++ SOURCES/conntrackd.service | 13 + SPECS/conntrack-tools.spec | 251 +++++++++++ 7 files changed, 771 insertions(+) create mode 100644 .conntrack-tools.metadata create mode 100644 .gitignore create mode 100644 SOURCES/conntrack-tools-1.4.4-free-pktb-after-use.patch create mode 100644 SOURCES/conntrack-tools-1.4.4-nat_tuple-leak.patch create mode 100644 SOURCES/conntrackd.conf create mode 100644 SOURCES/conntrackd.service create mode 100644 SPECS/conntrack-tools.spec diff --git a/.conntrack-tools.metadata b/.conntrack-tools.metadata new file mode 100644 index 0000000..174887b --- /dev/null +++ b/.conntrack-tools.metadata @@ -0,0 +1 @@ +25b36fb6832373ef899bade3b82adf5382b9a05b SOURCES/conntrack-tools-1.4.4.tar.bz2 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e5fee0e --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/conntrack-tools-1.4.4.tar.bz2 diff --git a/SOURCES/conntrack-tools-1.4.4-free-pktb-after-use.patch b/SOURCES/conntrack-tools-1.4.4-free-pktb-after-use.patch new file mode 100644 index 0000000..c43f23f --- /dev/null +++ b/SOURCES/conntrack-tools-1.4.4-free-pktb-after-use.patch @@ -0,0 +1,29 @@ +From 832166dc4780e259424ebab07b42ecf42cde6fe3 Mon Sep 17 00:00:00 2001 +From: Kevin Cernekee +Date: Fri, 27 Jan 2017 12:38:46 -0800 +Subject: conntrackd: cthelper: Free pktb after use + +According to valgrind, this currently leaks ~512B to 2kB for each +packet sent to the userspace helper. + +Signed-off-by: Kevin Cernekee +Signed-off-by: Pablo Neira Ayuso +--- + src/cthelper.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/cthelper.c b/src/cthelper.c +index 54eb830..f01c509 100644 +--- a/src/cthelper.c ++++ b/src/cthelper.c +@@ -325,6 +325,7 @@ static int nfq_queue_cb(const struct nlmsghdr *nlh, void *data) + if (pkt_verdict_issue(helper, myct, queue_num, id, verdict, pktb) < 0) + goto err4; + ++ pktb_free(pktb); + nfct_destroy(ct); + if (myct->exp != NULL) + nfexp_destroy(myct->exp); +-- +cgit v0.12 + diff --git a/SOURCES/conntrack-tools-1.4.4-nat_tuple-leak.patch b/SOURCES/conntrack-tools-1.4.4-nat_tuple-leak.patch new file mode 100644 index 0000000..802bd91 --- /dev/null +++ b/SOURCES/conntrack-tools-1.4.4-nat_tuple-leak.patch @@ -0,0 +1,57 @@ +From 1ba5e76a368aeb9fe17d3b691df4faa0dadc4523 Mon Sep 17 00:00:00 2001 +From: Kevin Cernekee +Date: Thu, 26 Jan 2017 16:44:24 -0800 +Subject: conntrackd: cthelper: Don't leak nat_tuple + +nfexp_set_attr() copies |nat_tuple| rather than taking ownership, so +it should be freed at the end of the loop. Some of the other helpers +(like rpc.c) do this, but it is missing here. + +Reported-by: Eric Caruso +Signed-off-by: Kevin Cernekee +Signed-off-by: Pablo Neira Ayuso +--- + src/helpers/amanda.c | 1 + + src/helpers/ftp.c | 1 + + src/helpers/tftp.c | 1 + + 3 files changed, 3 insertions(+) + +diff --git a/src/helpers/amanda.c b/src/helpers/amanda.c +index 9e6c4e7..faee1cd 100644 +--- a/src/helpers/amanda.c ++++ b/src/helpers/amanda.c +@@ -75,6 +75,7 @@ static int nat_amanda(struct pkt_buff *pkt, uint32_t ctinfo, + break; + } + } ++ nfct_destroy(nat_tuple); + + if (port == 0) { + pr_debug("all ports in use\n"); +diff --git a/src/helpers/ftp.c b/src/helpers/ftp.c +index 27ab5eb..c3aa284 100644 +--- a/src/helpers/ftp.c ++++ b/src/helpers/ftp.c +@@ -423,6 +423,7 @@ static unsigned int nf_nat_ftp(struct pkt_buff *pkt, + break; + } + } ++ nfct_destroy(nat_tuple); + + if (port == 0) + return NF_DROP; +diff --git a/src/helpers/tftp.c b/src/helpers/tftp.c +index 45591c6..70dd28a 100644 +--- a/src/helpers/tftp.c ++++ b/src/helpers/tftp.c +@@ -65,6 +65,7 @@ static unsigned int nat_tftp(struct pkt_buff *pkt, uint32_t ctinfo, + nfexp_set_attr_u32(exp, ATTR_EXP_NAT_DIR, MYCT_DIR_REPL); + nfexp_set_attr(exp, ATTR_EXP_FN, "nat-follow-master"); + nfexp_set_attr(exp, ATTR_EXP_NAT_TUPLE, nat_tuple); ++ nfct_destroy(nat_tuple); + + return NF_ACCEPT; + } +-- +cgit v0.12 + diff --git a/SOURCES/conntrackd.conf b/SOURCES/conntrackd.conf new file mode 100644 index 0000000..3970e91 --- /dev/null +++ b/SOURCES/conntrackd.conf @@ -0,0 +1,419 @@ + +# See also: http://conntrack-tools.netfilter.org/support.html +# +# There are 3 different modes of running conntrackd: "alarm", "notrack" and "ftfw" +# +# The default package ships with a FTFW configuration, see /usr/share/doc/conntrackd* +# for example configurations for other modes. + + +# +# Synchronizer settings +# +Sync { + Mode FTFW { + # + # Size of the resend queue (in objects). This is the maximum + # number of objects that can be stored waiting to be confirmed + # via acknoledgment. If you keep this value low, the daemon + # will have less chances to recover state-changes under message + # omission. On the other hand, if you keep this value high, + # the daemon will consume more memory to store dead objects. + # Default is 131072 objects. + # + # ResendQueueSize 131072 + + # + # This parameter allows you to set an initial fixed timeout + # for the committed entries when this node goes from backup + # to primary. This mechanism provides a way to purge entries + # that were not recovered appropriately after the specified + # fixed timeout. If you set a low value, TCP entries in + # Established states with no traffic may hang. For example, + # an SSH connection without KeepAlive enabled. If not set, + # the daemon uses an approximate timeout value calculation + # mechanism. By default, this option is not set. + # + # CommitTimeout 180 + + # + # If the firewall replica goes from primary to backup, + # the conntrackd -t command is invoked in the script. + # This command schedules a flush of the table in N seconds. + # This is useful to purge the connection tracking table of + # zombie entries and avoid clashes with old entries if you + # trigger several consecutive hand-overs. Default is 60 seconds. + # + # PurgeTimeout 60 + + # Set the acknowledgement window size. If you decrease this + # value, the number of acknowlegdments increases. More + # acknowledgments means more overhead as conntrackd has to + # handle more control messages. On the other hand, if you + # increase this value, the resend queue gets more populated. + # This results in more overhead in the queue releasing. + # The following value is based on some practical experiments + # measuring the cycles spent by the acknowledgment handling + # with oprofile. If not set, default window size is 300. + # + # ACKWindowSize 300 + + # + # This clause allows you to disable the external cache. Thus, + # the state entries are directly injected into the kernel + # conntrack table. As a result, you save memory in user-space + # but you consume slots in the kernel conntrack table for + # backup state entries. Moreover, disabling the external cache + # means more CPU consumption. You need a Linux kernel + # >= 2.6.29 to use this feature. By default, this clause is + # set off. If you are installing conntrackd for first time, + # please read the user manual and I encourage you to consider + # using the fail-over scripts instead of enabling this option! + # + # DisableExternalCache Off + } + + # + # Multicast IP and interface where messages are + # broadcasted (dedicated link). IMPORTANT: Make sure + # that iptables accepts traffic for destination + # 225.0.0.50, eg: + # + # iptables -I INPUT -d 225.0.0.50 -j ACCEPT + # iptables -I OUTPUT -d 225.0.0.50 -j ACCEPT + # + Multicast { + # + # Multicast address: The address that you use as destination + # in the synchronization messages. You do not have to add + # this IP to any of your existing interfaces. If any doubt, + # do not modify this value. + # + IPv4_address 225.0.0.50 + + # + # The multicast group that identifies the cluster. If any + # doubt, do not modify this value. + # + Group 3780 + + # + # IP address of the interface that you are going to use to + # send the synchronization messages. Remember that you must + # use a dedicated link for the synchronization messages. + # + IPv4_interface 192.168.100.100 + + # + # The name of the interface that you are going to use to + # send the synchronization messages. + # + Interface eth2 + + # The multicast sender uses a buffer to enqueue the packets + # that are going to be transmitted. The default size of this + # socket buffer is available at /proc/sys/net/core/wmem_default. + # This value determines the chances to have an overrun in the + # sender queue. The overrun results packet loss, thus, losing + # state information that would have to be retransmitted. If you + # notice some packet loss, you may want to increase the size + # of the sender buffer. The default size is usually around + # ~100 KBytes which is fairly small for busy firewalls. + # + SndSocketBuffer 1249280 + + # The multicast receiver uses a buffer to enqueue the packets + # that the socket is pending to handle. The default size of this + # socket buffer is available at /proc/sys/net/core/rmem_default. + # This value determines the chances to have an overrun in the + # receiver queue. The overrun results packet loss, thus, losing + # state information that would have to be retransmitted. If you + # notice some packet loss, you may want to increase the size of + # the receiver buffer. The default size is usually around + # ~100 KBytes which is fairly small for busy firewalls. + # + RcvSocketBuffer 1249280 + + # + # Enable/Disable message checksumming. This is a good + # property to achieve fault-tolerance. In case of doubt, do + # not modify this value. + # + Checksum on + } + # + # You can specify more than one dedicated link. Thus, if one dedicated + # link fails, conntrackd can fail-over to another. Note that adding + # more than one dedicated link does not mean that state-updates will + # be sent to all of them. There is only one active dedicated link at + # a given moment. The `Default' keyword indicates that this interface + # will be selected as the initial dedicated link. You can have + # up to 4 redundant dedicated links. Note: Use different multicast + # groups for every redundant link. + # + # Multicast Default { + # IPv4_address 225.0.0.51 + # Group 3781 + # IPv4_interface 192.168.100.101 + # Interface eth3 + # # SndSocketBuffer 1249280 + # # RcvSocketBuffer 1249280 + # Checksum on + # } + + # + # You can use Unicast UDP instead of Multicast to propagate events. + # Note that you cannot use unicast UDP and Multicast at the same + # time, you can only select one. + # + # UDP { + # + # UDP address that this firewall uses to listen to events. + # + # IPv4_address 192.168.2.100 + # + # or you may want to use an IPv6 address: + # + # IPv6_address fe80::215:58ff:fe28:5a27 + + # + # Destination UDP address that receives events, ie. the other + # firewall's dedicated link address. + # + # IPv4_Destination_Address 192.168.2.101 + # + # or you may want to use an IPv6 address: + # + # IPv6_Destination_Address fe80::2d0:59ff:fe2a:775c + + # + # UDP port used + # + # Port 3780 + + # + # The name of the interface that you are going to use to + # send the synchronization messages. + # + # Interface eth2 + + # + # The sender socket buffer size + # + # SndSocketBuffer 1249280 + + # + # The receiver socket buffer size + # + # RcvSocketBuffer 1249280 + + # + # Enable/Disable message checksumming. + # + # Checksum on + # } + + # + # Other unsorted options that are related to the synchronization. + # + # Options { + # + # TCP state-entries have window tracking disabled by default, + # you can enable it with this option. As said, default is off. + # This feature requires a Linux kernel >= 2.6.36. + # + # TCPWindowTracking Off + # } +} + +# +# General settings +# +General { + # + # Set the nice value of the daemon, this value goes from -20 + # (most favorable scheduling) to 19 (least favorable). Using a + # very low value reduces the chances to lose state-change events. + # Default is 0 but this example file sets it to most favourable + # scheduling as this is generally a good idea. See man nice(1) for + # more information. + # + Nice -20 + + # + # Select a different scheduler for the daemon, you can select between + # RR and FIFO and the process priority (minimum is 0, maximum is 99). + # See man sched_setscheduler(2) for more information. Using a RT + # scheduler reduces the chances to overrun the Netlink buffer. + # + # Scheduler { + # Type FIFO + # Priority 99 + # } + + # + # Number of buckets in the cache hashtable. The bigger it is, + # the closer it gets to O(1) at the cost of consuming more memory. + # Read some documents about tuning hashtables for further reference. + # + HashSize 32768 + + # + # Maximum number of conntracks, it should be double of: + # $ cat /proc/sys/net/netfilter/nf_conntrack_max + # since the daemon may keep some dead entries cached for possible + # retransmission during state synchronization. + # + HashLimit 131072 + + # + # Logfile: on (/var/log/conntrackd.log), off, or a filename + # Default: off + # + LogFile on + + # + # Syslog: on, off or a facility name (daemon (default) or local0..7) + # Default: off + # + #Syslog on + + # + # Lockfile + # + LockFile /var/lock/conntrack.lock + + # + # Unix socket configuration + # + UNIX { + Path /var/run/conntrackd.ctl + Backlog 20 + } + + # + # Netlink event socket buffer size. If you do not specify this clause, + # the default buffer size value in /proc/net/core/rmem_default is + # used. This default value is usually around 100 Kbytes which is + # fairly small for busy firewalls. This leads to event message dropping + # and high CPU consumption. This example configuration file sets the + # size to 2 MBytes to avoid this sort of problems. + # + NetlinkBufferSize 2097152 + + # + # The daemon doubles the size of the netlink event socket buffer size + # if it detects netlink event message dropping. This clause sets the + # maximum buffer size growth that can be reached. This example file + # sets the size to 8 MBytes. + # + NetlinkBufferSizeMaxGrowth 8388608 + + # + # If the daemon detects that Netlink is dropping state-change events, + # it automatically schedules a resynchronization against the Kernel + # after 30 seconds (default value). Resynchronizations are expensive + # in terms of CPU consumption since the daemon has to get the full + # kernel state-table and purge state-entries that do not exist anymore. + # Be careful of setting a very small value here. You have the following + # choices: On (enabled, use default 30 seconds value), Off (disabled) + # or Value (in seconds, to set a specific amount of time). If not + # specified, the daemon assumes that this option is enabled. + # + # NetlinkOverrunResync On + + # + # If you want reliable event reporting over Netlink, set on this + # option. If you set on this clause, it is a good idea to set off + # NetlinkOverrunResync. This option is off by default and you need + # a Linux kernel >= 2.6.31. + # + # NetlinkEventsReliable Off + + # + # By default, the daemon receives state updates following an + # event-driven model. You can modify this behaviour by switching to + # polling mode with the PollSecs clause. This clause tells conntrackd + # to dump the states in the kernel every N seconds. With regards to + # synchronization mode, the polling mode can only guarantee that + # long-lifetime states are recovered. The main advantage of this method + # is the reduction in the state replication at the cost of reducing the + # chances of recovering connections. + # + # PollSecs 15 + + # + # The daemon prioritizes the handling of state-change events coming + # from the core. With this clause, you can set the maximum number of + # state-change events (those coming from kernel-space) that the daemon + # will handle after which it will handle other events coming from the + # network or userspace. A low value improves interactivity (in terms of + # real-time behaviour) at the cost of extra CPU consumption. + # Default (if not set) is 100. + # + # EventIterationLimit 100 + + # + # Event filtering: This clause allows you to filter certain traffic, + # There are currently three filter-sets: Protocol, Address and + # State. The filter is attached to an action that can be: Accept or + # Ignore. Thus, you can define the event filtering policy of the + # filter-sets in positive or negative logic depending on your needs. + # You can select if conntrackd filters the event messages from + # user-space or kernel-space. The kernel-space event filtering + # saves some CPU cycles by avoiding the copy of the event message + # from kernel-space to user-space. The kernel-space event filtering + # is prefered, however, you require a Linux kernel >= 2.6.29 to + # filter from kernel-space. If you want to select kernel-space + # event filtering, use the keyword 'Kernelspace' instead of + # 'Userspace'. + # + Filter From Userspace { + # + # Accept only certain protocols: You may want to replicate + # the state of flows depending on their layer 4 protocol. + # + Protocol Accept { + TCP + SCTP + DCCP + # UDP + # ICMP # This requires a Linux kernel >= 2.6.31 + # IPv6-ICMP # This requires a Linux kernel >= 2.6.31 + } + + # + # Ignore traffic for a certain set of IP's: Usually all the + # IP assigned to the firewall since local traffic must be + # ignored, only forwarded connections are worth to replicate. + # Note that these values depends on the local IPs that are + # assigned to the firewall. + # + Address Ignore { + IPv4_address 127.0.0.1 # loopback + IPv4_address 192.168.0.100 # virtual IP 1 + IPv4_address 192.168.1.100 # virtual IP 2 + IPv4_address 192.168.0.1 + IPv4_address 192.168.1.1 + IPv4_address 192.168.100.100 # dedicated link ip + # + # You can also specify networks in format IP/cidr. + # IPv4_address 192.168.0.0/24 + # + # You can also specify an IPv6 address + # IPv6_address ::1 + } + + # + # Uncomment this line below if you want to filter by flow state. + # This option introduces a trade-off in the replication: it + # reduces CPU consumption at the cost of having lazy backup + # firewall replicas. The existing TCP states are: SYN_SENT, + # SYN_RECV, ESTABLISHED, FIN_WAIT, CLOSE_WAIT, LAST_ACK, + # TIME_WAIT, CLOSED, LISTEN. + # + # State Accept { + # ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP + # } + } +} diff --git a/SOURCES/conntrackd.service b/SOURCES/conntrackd.service new file mode 100644 index 0000000..9c108d7 --- /dev/null +++ b/SOURCES/conntrackd.service @@ -0,0 +1,13 @@ +[Unit] +Description=connection tracking daemon for debugging and High Availablity +After=network-online.target +Wants=network-online.target + +[Service] +Type=simple +# rhbz#1255578 daemon will not start if lock file is left dangling +ExecStartPre=/bin/rm -f /var/lock/conntrack.lock +ExecStart=/usr/sbin/conntrackd -C /etc/conntrackd/conntrackd.conf + +[Install] +WantedBy=multi-user.target diff --git a/SPECS/conntrack-tools.spec b/SPECS/conntrack-tools.spec new file mode 100644 index 0000000..d920383 --- /dev/null +++ b/SPECS/conntrack-tools.spec @@ -0,0 +1,251 @@ +Name: conntrack-tools +Version: 1.4.4 +Release: 9%{?dist} +Summary: Manipulate netfilter connection tracking table and run High Availability +Group: System Environment/Base +License: GPLv2 +URL: http://conntrack-tools.netfilter.org/ +Source0: http://netfilter.org/projects/%{name}/files/%{name}-%{version}.tar.bz2 +Source1: conntrackd.service +Source2: conntrackd.conf + +Patch1: conntrack-tools-1.4.4-nat_tuple-leak.patch +Patch2: conntrack-tools-1.4.4-free-pktb-after-use.patch + +BuildRequires: libnfnetlink-devel >= 1.0.1, libnetfilter_conntrack-devel >= 1.0.6 +BuildRequires: libnetfilter_cttimeout-devel >= 1.0.0, libnetfilter_cthelper-devel >= 1.0.0 +BuildRequires: libmnl-devel >= 1.0.3, libnetfilter_queue-devel >= 1.0.2 +BuildRequires: libtirpc-devel systemd-devel +BuildRequires: pkgconfig bison flex +Provides: conntrack = 1.0-1 +Obsoletes: conntrack < 1.0-1 +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd +BuildRequires: systemd + +%description +With conntrack-tools you can setup a High Availability cluster and +synchronize conntrack state between multiple firewalls. + +The conntrack-tools package contains two programs: +- conntrack: the command line interface to interact with the connection + tracking system. +- conntrackd: the connection tracking userspace daemon that can be used to + deploy highly available GNU/Linux firewalls and collect + statistics of the firewall use. + +conntrack is used to search, list, inspect and maintain the netfilter +connection tracking subsystem of the Linux kernel. +Using conntrack, you can dump a list of all (or a filtered selection of) +currently tracked connections, delete connections from the state table, +and even add new ones. +In addition, you can also monitor connection tracking events, e.g. +show an event message (one line) per newly established connection. + +%prep +%setup -q +%patch1 -p1 +%patch2 -p1 + +%build +export LDFLAGS="${LDFLAGS} -Wl,-z,lazy" +%configure --disable-static --enable-systemd +sed -i "s/DEFAULT_INCLUDES = -I./DEFAULT_INCLUDES = -I. -I\/usr\/include\/tirpc/" src/helpers/Makefile + +%make_build +chmod 644 doc/sync/primary-backup.sh +rm -f doc/sync/notrack/conntrackd.conf.orig doc/sync/alarm/conntrackd.conf.orig doc/helper/conntrackd.conf.orig + +%install +%make_install +find %{buildroot} -type f -name "*.la" -exec rm -f {} ';' +mkdir -p %{buildroot}%{_sysconfdir}/conntrackd +install -d -m 0755 %{buildroot}%{_unitdir} +install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/ +install -m 0644 %{SOURCE2} %{buildroot}%{_sysconfdir}/conntrackd/ + +%files +%license COPYING +%doc AUTHORS TODO doc +%dir %{_sysconfdir}/conntrackd +%config(noreplace) %{_sysconfdir}/conntrackd/conntrackd.conf +%{_unitdir}/conntrackd.service +%{_sbindir}/conntrack +%{_sbindir}/conntrackd +%{_sbindir}/nfct +%{_mandir}/man5/* +%{_mandir}/man8/* +%dir %{_libdir}/conntrack-tools +%{_libdir}/conntrack-tools/* + +%post +%systemd_post conntrackd.service + +%preun +%systemd_preun conntrackd.service + +%postun +%systemd_postun conntrackd.service + +%changelog +* Thu Feb 14 2019 Phil Sutter - 1.4.4-9 +- Fix previous attempt at linking with -z lazy + +* Tue Dec 11 2018 Paul Wouters - 1.4.4-8 +- Resolves: rhbz#1646885 [RHEL8] nfct tool lib have undefined symbol +- enable systemd support + +* Thu Apr 12 2018 Orion Poplawski - 1.4.4-7 +- Use libtirpc +- Use %%license + +* Wed Feb 07 2018 Fedora Release Engineering - 1.4.4-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Wed Aug 02 2017 Fedora Release Engineering - 1.4.4-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Wed Jul 26 2017 Fedora Release Engineering - 1.4.4-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Wed Feb 22 2017 Paul Wouters - 1.4.4-3 +- Add upstream patches (free pktb after use, nat_tuple leak) + +* Fri Feb 10 2017 Fedora Release Engineering - 1.4.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Thu Sep 22 2016 Paul Wouters - 1.4.4-1 +- Updated to 1.4.4 (rhbz#1370668) +- Include new man5 pages + +* Wed Apr 20 2016 Paul Wouters - 1.4.3-1 +- Resolves: rhbz#1261220 1.4.3 is available +- Update source url +- Remove incorporated patches + +* Wed Feb 03 2016 Fedora Release Engineering - 1.4.2-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Fri Aug 21 2015 Paul Wouters - 1.4.2-10 +- Resolves: 1255578 - conntrackd could neither be started nor be stopped + +* Tue Aug 18 2015 Paul Wouters - 1.4.2-9 +- Resolves: rhbz#CVE-2015-6496, rhbz#1253757 +- Fold in upstream patches since 1.4.2 release up to git 900d7e8 +- Fold in upstream patch set of 2015-08-18 for coverity issues + +* Wed Jun 17 2015 Fedora Release Engineering - 1.4.2-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Mon Jan 12 2015 Paul Komkoff - 1.4.2-7 +- bz#1181119 - wait for network to be on before starting conntrackd + +* Sun Jan 11 2015 Paul Komkoff - 1.4.2-6 +- bz#998105 - remove patch residues from doc + +* Sat Aug 16 2014 Fedora Release Engineering - 1.4.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Sat Jun 07 2014 Fedora Release Engineering - 1.4.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Sat Dec 21 2013 Paul Komkoff - 1.4.2-3 +- rebuilt + +* Sat Sep 7 2013 Paul P. Komkoff Jr - 1.4.2-2 +- bz#850067 + +* Sat Sep 7 2013 Paul P. Komkoff Jr - 1.4.2-1 +- new upstream version + +* Sat Aug 03 2013 Fedora Release Engineering - 1.4.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Fri Feb 08 2013 Paul Komkoff - 1.4.0-2 +- fix bz#909128 + +* Mon Nov 26 2012 Paul P. Komkoff Jr - 1.4.0-1 +- new upstream version + +* Tue Jul 24 2012 Paul P. Komkoff Jr - 1.2.1 +- new upstream version + +* Wed Jul 18 2012 Fedora Release Engineering - 1.0.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Mon May 07 2012 Paul Wouters - 1.0.1-1 +- Updated to 1.0.1 +- Added daemon using systemd and configuration file +- Removed legacy spec requirements +- Patch for: parse.c:240:34: error: 'NULL' undeclared + +* Thu Jan 12 2012 Fedora Release Engineering - 1.0.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Thu May 5 2011 Paul P. Komkoff Jr - 1.0.0 +- new upstream version + +* Wed Feb 09 2011 Fedora Release Engineering - 0.9.15-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Fri Nov 19 2010 Paul P. Komkoff Jr - 0.9.15-1 +- new upstream version + +* Thu Mar 25 2010 Paul P. Komkoff Jr - 0.9.14-1 +- update, at last + +* Tue Nov 10 2009 Paul P. Komkoff Jr - 0.9.13-2 +- failed to properly commit the package :( + +* Tue Oct 13 2009 Paul P. Komkoff Jr - 0.9.13-1 +- new upstream version + +* Fri Jul 24 2009 Fedora Release Engineering - 0.9.12-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Sun May 24 2009 Paul P. Komkoff Jr - 0.9.12-3 +- new upstream version + +* Sun May 24 2009 Paul P. Komkoff Jr - 0.9.12-2 +- versioning screwup + +* Sun May 24 2009 Paul P. Komkoff Jr - 0.9.12-1 +- new upstream version + +* Tue Feb 24 2009 Fedora Release Engineering - 0.9.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Tue Jan 13 2009 Paul P. Komkoff Jr - 0.9.9-1 +- new upstream version + +* Sun Oct 26 2008 Paul P. Komkoff Jr - 0.9.8-1 +- new upstream version +- remove rollup patch + +* Wed Jul 16 2008 Paul P. Komkoff Jr - 0.9.7-2 +- fix Patch0/%%patch. + +* Wed Jul 16 2008 Paul P. Komkoff Jr - 0.9.7-1 +- new upstream version + +* Sat Feb 23 2008 Paul P. Komkoff Jr - 0.9.6-0.1.svn7382 +- new version from svn + +* Fri Feb 22 2008 Paul P. Komkoff Jr - 0.9.5-5 +- fix the PATH_MAX-related compilation problem + +* Tue Feb 19 2008 Fedora Release Engineering - 0.9.5-4 +- Autorebuild for GCC 4.3 + +* Tue Oct 23 2007 Paul P. Komkoff Jr - 0.9.5-3 +- review fixes + +* Sun Oct 21 2007 Paul P. Komkoff Jr - 0.9.5-2 +- review fixes + +* Fri Oct 19 2007 Paul P. Komkoff Jr - 0.9.5-1 +- new upstream version + +* Sun Jul 22 2007 Paul P. Komkoff Jr - 0.9.4-1 +- replace conntrack with conntrack-tools