RHEL 9.0.0 Alpha bootstrap

The content of this branch was automatically imported from Fedora ELN
with the following as its source:
https://src.fedoraproject.org/rpms/conntrack-tools#96cbd06f4de157b82890465ca967e1aac3f43429

.gitignore

@@ -0,0 +1,9 @@
+conntrack-tools-0.9.14.tar.bz2
+/conntrack-tools-0.9.15.tar.bz2
+/conntrack-tools-1.0.0.tar.bz2
+/conntrack-tools-1.0.1.tar.bz2
+/conntrack-tools-1.4.0.tar.bz2
+/conntrack-tools-1.4.2.tar.bz2
+/conntrack-tools-1.4.3.tar.bz2
+/conntrack-tools-1.4.4.tar.bz2
+/conntrack-tools-1.4.5.tar.bz2

conntrack-tools-1.4.4-free-pktb-after-use.patch

@@ -0,0 +1,29 @@
+From 832166dc4780e259424ebab07b42ecf42cde6fe3 Mon Sep 17 00:00:00 2001
+From: Kevin Cernekee <cernekee@chromium.org>
+Date: Fri, 27 Jan 2017 12:38:46 -0800
+Subject: conntrackd: cthelper: Free pktb after use
+
+According to valgrind, this currently leaks ~512B to 2kB for each
+packet sent to the userspace helper.
+
+Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ src/cthelper.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/cthelper.c b/src/cthelper.c
+index 54eb830..f01c509 100644
+--- a/src/cthelper.c
++++ b/src/cthelper.c
+@@ -325,6 +325,7 @@ static int nfq_queue_cb(const struct nlmsghdr *nlh, void *data)
+ 	if (pkt_verdict_issue(helper, myct, queue_num, id, verdict, pktb) < 0)
+ 		goto err4;
+ 
++	pktb_free(pktb);
+ 	nfct_destroy(ct);
+ 	if (myct->exp != NULL)
+ 		nfexp_destroy(myct->exp);
+-- 
+cgit v0.12
+

conntrack-tools-1.4.4-nat_tuple-leak.patch

@@ -0,0 +1,57 @@
+From 1ba5e76a368aeb9fe17d3b691df4faa0dadc4523 Mon Sep 17 00:00:00 2001
+From: Kevin Cernekee <cernekee@chromium.org>
+Date: Thu, 26 Jan 2017 16:44:24 -0800
+Subject: conntrackd: cthelper: Don't leak nat_tuple
+
+nfexp_set_attr() copies |nat_tuple| rather than taking ownership, so
+it should be freed at the end of the loop.  Some of the other helpers
+(like rpc.c) do this, but it is missing here.
+
+Reported-by: Eric Caruso <ejcaruso@chromium.org>
+Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ src/helpers/amanda.c | 1 +
+ src/helpers/ftp.c    | 1 +
+ src/helpers/tftp.c   | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/src/helpers/amanda.c b/src/helpers/amanda.c
+index 9e6c4e7..faee1cd 100644
+--- a/src/helpers/amanda.c
++++ b/src/helpers/amanda.c
+@@ -75,6 +75,7 @@ static int nat_amanda(struct pkt_buff *pkt, uint32_t ctinfo,
+ 			break;
+ 		}
+ 	}
++	nfct_destroy(nat_tuple);
+ 
+ 	if (port == 0) {
+ 		pr_debug("all ports in use\n");
+diff --git a/src/helpers/ftp.c b/src/helpers/ftp.c
+index 27ab5eb..c3aa284 100644
+--- a/src/helpers/ftp.c
++++ b/src/helpers/ftp.c
+@@ -423,6 +423,7 @@ static unsigned int nf_nat_ftp(struct pkt_buff *pkt,
+ 			break;
+ 		}
+ 	}
++	nfct_destroy(nat_tuple);
+ 
+ 	if (port == 0)
+ 		return NF_DROP;
+diff --git a/src/helpers/tftp.c b/src/helpers/tftp.c
+index 45591c6..70dd28a 100644
+--- a/src/helpers/tftp.c
++++ b/src/helpers/tftp.c
+@@ -65,6 +65,7 @@ static unsigned int nat_tftp(struct pkt_buff *pkt, uint32_t ctinfo,
+ 	nfexp_set_attr_u32(exp, ATTR_EXP_NAT_DIR, MYCT_DIR_REPL);
+ 	nfexp_set_attr(exp, ATTR_EXP_FN, "nat-follow-master");
+ 	nfexp_set_attr(exp, ATTR_EXP_NAT_TUPLE, nat_tuple);
++	nfct_destroy(nat_tuple);
+ 
+ 	return NF_ACCEPT;
+ }
+-- 
+cgit v0.12
+

conntrack-tools-coverity20150818.patch

@@ -0,0 +1,217 @@
+diff --git a/src/cache.c b/src/cache.c
+index 7c41e54..79a024f 100644
+--- a/src/cache.c
++++ b/src/cache.c
+@@ -34,7 +34,7 @@ struct cache_feature *cache_feature[CACHE_MAX_FEATURE] = {
+ };
+ 
+ struct cache *cache_create(const char *name, enum cache_type type,
+-			   unsigned int features, 
++			   unsigned int features,
+ 			   struct cache_extra *extra,
+ 			   struct cache_ops *ops)
+ {
+@@ -53,7 +53,8 @@ struct cache *cache_create(const char *name, enum cache_type type,
+ 		return NULL;
+ 	memset(c, 0, sizeof(struct cache));
+ 
+-	strcpy(c->name, name);
++	strncpy(c->name, name, CACHE_MAX_NAMELEN);
++	c->name[CACHE_MAX_NAMELEN - 1] = '\0';
+ 	c->type = type;
+ 
+ 	for (i = 0; i < CACHE_MAX_FEATURE; i++) {
+diff --git a/src/cthelper.c b/src/cthelper.c
+index 6537515..54eb830 100644
+--- a/src/cthelper.c
++++ b/src/cthelper.c
+@@ -277,11 +277,11 @@ static int nfq_queue_cb(const struct nlmsghdr *nlh, void *data)
+ 
+ 	if (!attr[NFQA_PAYLOAD]) {
+ 		dlog(LOG_ERR, "packet with no payload");
+-		goto err;
++		goto err1;
+ 	}
+ 	if (!attr[NFQA_CT] || !attr[NFQA_CT_INFO]) {
+ 		dlog(LOG_ERR, "no CT attached to this packet");
+-		goto err;
++		goto err1;
+ 	}
+ 
+ 	pkt = mnl_attr_get_payload(attr[NFQA_PAYLOAD]);
+@@ -292,22 +292,22 @@ static int nfq_queue_cb(const struct nlmsghdr *nlh, void *data)
+ 	queue_num = ntohs(nfg->res_id);
+ 
+ 	if (pkt_get(pkt, pktlen, ntohs(ph->hw_protocol), &protoff))
+-		goto err;
++		goto err1;
+ 
+ 	ct = nfct_new();
+ 	if (ct == NULL)
+-		goto err;
++		goto err1;
+ 
+ 	if (nfct_payload_parse(mnl_attr_get_payload(attr[NFQA_CT]),
+ 			       mnl_attr_get_payload_len(attr[NFQA_CT]),
+ 			       l3num, ct) < 0) {
+ 		dlog(LOG_ERR, "cannot convert message to CT");
+-		goto err;
++		goto err2;
+ 	}
+ 
+ 	myct = calloc(1, sizeof(struct myct));
+ 	if (myct == NULL)
+-		goto err;
++		goto err2;
+ 
+ 	myct->ct = ct;
+ 	ctinfo = ntohl(mnl_attr_get_u32(attr[NFQA_CT_INFO]));
+@@ -315,15 +315,15 @@ static int nfq_queue_cb(const struct nlmsghdr *nlh, void *data)
+ 	/* XXX: 256 bytes enough for possible NAT mangling in helpers? */
+ 	pktb = pktb_alloc(AF_INET, pkt, pktlen, 256);
+ 	if (pktb == NULL)
+-		goto err;
++		goto err3;
+ 
+ 	/* Misconfiguration: if no helper found, accept the packet. */
+ 	helper = helper_run(pktb, protoff, myct, ctinfo, queue_num, &verdict);
+ 	if (!helper)
+-		goto err_pktb;
++		goto err4;
+ 
+ 	if (pkt_verdict_issue(helper, myct, queue_num, id, verdict, pktb) < 0)
+-		goto err_pktb;
++		goto err4;
+ 
+ 	nfct_destroy(ct);
+ 	if (myct->exp != NULL)
+@@ -333,18 +333,19 @@ static int nfq_queue_cb(const struct nlmsghdr *nlh, void *data)
+ 	free(myct);
+ 
+ 	return MNL_CB_OK;
+-err_pktb:
++err4:
+ 	pktb_free(pktb);
+-err:
++err3:
++	free(myct);
++err2:
++	nfct_destroy(ct);
++err1:
+ 	/* In case of error, we don't want to disrupt traffic. We accept all.
+ 	 * This is connection tracking after all. The policy is not to drop
+ 	 * packet unless we enter some inconsistent state.
+ 	 */
+ 	pkt_verdict_error(queue_num, id);
+ 
+-	if (ct != NULL)
+-		nfct_destroy(ct);
+-
+ 	return MNL_CB_OK;
+ }
+ 
+diff --git a/src/local.c b/src/local.c
+index 453799a..3395b4c 100644
+--- a/src/local.c
++++ b/src/local.c
+@@ -77,7 +77,7 @@ int do_local_server_step(struct local_server *server, void *data,
+ 	int rfd;
+ 	struct sockaddr_un local;
+ 	socklen_t sin_size = sizeof(struct sockaddr_un);
+-	
++
+ 	rfd = accept(server->fd, (struct sockaddr *) &local, &sin_size);
+ 	if (rfd == -1)
+ 		return -1;
+@@ -147,11 +147,14 @@ int do_local_request(int request,
+ 
+ 	ret = send(fd, &request, sizeof(int), 0);
+ 	if (ret == -1)
+-		return -1;
++		goto err1;
+ 
+ 	do_local_client_step(fd, step);
+ 
+ 	local_client_destroy(fd);
+-	
++
+ 	return 0;
++err1:
++	local_client_destroy(fd);
++	return -1;
+ }
+diff --git a/src/parse.c b/src/parse.c
+index f3ec6ac..919d36c 100644
+--- a/src/parse.c
++++ b/src/parse.c
+@@ -297,7 +297,7 @@ int msg2ct(struct nf_conntrack *ct, struct nethdr *net, size_t remain)
+ 			return -1;
+ 		if (attr->nta_len < NTA_LENGTH(0))
+ 			return -1;
+-		if (attr->nta_attr > NTA_MAX)
++		if (attr->nta_attr >= NTA_MAX)
+ 			return -1;
+ 		if (h[attr->nta_attr].size &&
+ 		    attr->nta_len != h[attr->nta_attr].size)
+@@ -510,7 +510,7 @@ int msg2exp(struct nf_expect *exp, struct nethdr *net, size_t remain)
+ 		ATTR_NETWORK2HOST(attr);
+ 		if (attr->nta_len > len)
+ 			goto err;
+-		if (attr->nta_attr > NTA_MAX)
++		if (attr->nta_attr >= NTA_EXP_MAX)
+ 			goto err;
+ 		if (attr->nta_len < NTA_LENGTH(0))
+ 			goto err;
+@@ -524,13 +524,15 @@ int msg2exp(struct nf_expect *exp, struct nethdr *net, size_t remain)
+ 			attr = NTA_NEXT(attr, len);
+ 			continue;
+ 		}
+-		switch(exp_h[attr->nta_attr].exp_attr) {
++		switch (exp_h[attr->nta_attr].exp_attr) {
+ 		case ATTR_EXP_MASTER:
+ 			exp_h[attr->nta_attr].parse(master, attr->nta_attr,
+ 						    NTA_DATA(attr));
++			break;
+ 		case ATTR_EXP_EXPECTED:
+ 			exp_h[attr->nta_attr].parse(expected, attr->nta_attr,
+ 						    NTA_DATA(attr));
++			break;
+ 		case ATTR_EXP_MASK:
+ 			exp_h[attr->nta_attr].parse(mask, attr->nta_attr,
+ 						    NTA_DATA(attr));
+diff --git a/src/process.c b/src/process.c
+index 7f0a395..3ddad5f 100644
+--- a/src/process.c
++++ b/src/process.c
+@@ -48,6 +48,8 @@ int fork_process_new(int type, int flags, void (*cb)(void *data), void *data)
+ 
+ 	if (c->pid > 0)
+ 		list_add(&c->head, &process_list);
++	else
++		free(c);
+ 
+ 	return pid;
+ }
+diff --git a/src/tcp.c b/src/tcp.c
+index af27c46..e570880 100644
+--- a/src/tcp.c
++++ b/src/tcp.c
+@@ -247,13 +247,11 @@ int tcp_accept(struct tcp_sock *m)
+ 	/* the other peer wants to connect ... */
+ 	ret = accept(m->fd, NULL, NULL);
+ 	if (ret == -1) {
+-		if (errno != EAGAIN) {
+-			/* unexpected error. Give us another try. */
+-			m->state = TCP_SERVER_ACCEPTING;
+-		} else {
+-			/* waiting for new connections. */
+-			m->state = TCP_SERVER_ACCEPTING;
+-		}
++	/* unexpected error: Give us another try. Or we have hit
++	 * -EAGAIN, in that case we remain in the accepting connections
++	 * state.
++	 */
++	m->state = TCP_SERVER_ACCEPTING;
+ 	} else {
+ 		/* the peer finally got connected. */
+ 		if (fcntl(ret, F_SETFL, O_NONBLOCK) == -1) {

conntrack-tools.spec

@@ -0,0 +1,267 @@
+%undefine _hardened_build
+Name:           conntrack-tools
+Version:        1.4.5
+Release:        6%{?dist}
+Summary:        Manipulate netfilter connection tracking table and run High Availability
+License:        GPLv2
+URL:            http://conntrack-tools.netfilter.org/
+Source0:        http://netfilter.org/projects/%{name}/files/%{name}-%{version}.tar.bz2
+Source1:        conntrackd.service
+Source2:        conntrackd.conf
+
+BuildRequires:  gcc
+BuildRequires:  libnfnetlink-devel >= 1.0.1, libnetfilter_conntrack-devel >= 1.0.7
+BuildRequires:  libnetfilter_cttimeout-devel >= 1.0.0, libnetfilter_cthelper-devel >= 1.0.0
+BuildRequires:  libmnl-devel >= 1.0.3, libnetfilter_queue-devel >= 1.0.2
+BuildRequires:  libtirpc-devel systemd-devel
+BuildRequires:  pkgconfig bison flex
+Provides:       conntrack = 1.0-1
+Obsoletes:      conntrack < 1.0-1
+Requires(post): systemd
+Requires(preun): systemd
+Requires(postun): systemd
+BuildRequires: systemd
+
+%description
+With conntrack-tools you can setup a High Availability cluster and
+synchronize conntrack state between multiple firewalls.
+
+The conntrack-tools package contains two programs:
+- conntrack: the command line interface to interact with the connection
+             tracking system.
+- conntrackd: the connection tracking userspace daemon that can be used to
+              deploy highly available GNU/Linux firewalls and collect
+              statistics of the firewall use.
+
+conntrack is used to search, list, inspect and maintain the netfilter
+connection tracking subsystem of the Linux kernel.
+Using conntrack, you can dump a list of all (or a filtered selection  of)
+currently tracked connections, delete connections from the state table, 
+and even add new ones.
+In addition, you can also monitor connection tracking events, e.g. 
+show an event message (one line) per newly established connection.
+
+%prep
+%setup -q
+
+%build
+%configure --disable-static --enable-systemd
+sed -i "s/DEFAULT_INCLUDES = -I./DEFAULT_INCLUDES = -I. -I\/usr\/include\/tirpc/" src/helpers/Makefile
+CFLAGS="${CFLAGS} -Wl,-z,lazy"
+CXXFLAGS="${CXXFLAGS} -Wl,-z,lazy"
+%make_build
+chmod 644 doc/sync/primary-backup.sh
+rm -f doc/sync/notrack/conntrackd.conf.orig doc/sync/alarm/conntrackd.conf.orig doc/helper/conntrackd.conf.orig
+
+%install
+%make_install
+find %{buildroot} -type f -name "*.la" -exec rm -f {} ';'
+mkdir -p %{buildroot}%{_sysconfdir}/conntrackd
+install -d -m 0755 %{buildroot}%{_unitdir}
+install -m 0644 %{SOURCE1} %{buildroot}%{_unitdir}/
+install -m 0644 %{SOURCE2} %{buildroot}%{_sysconfdir}/conntrackd/
+
+%files
+%license COPYING
+%doc AUTHORS TODO doc
+%dir %{_sysconfdir}/conntrackd
+%config(noreplace) %{_sysconfdir}/conntrackd/conntrackd.conf
+%{_unitdir}/conntrackd.service
+%{_sbindir}/conntrack
+%{_sbindir}/conntrackd
+%{_sbindir}/nfct
+%{_mandir}/man5/*
+%{_mandir}/man8/*
+%dir %{_libdir}/conntrack-tools
+%{_libdir}/conntrack-tools/*
+
+%post
+%systemd_post conntrackd.service
+
+%preun
+%systemd_preun conntrackd.service
+
+%postun
+%systemd_postun conntrackd.service 
+
+%changelog
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.5-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.5-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.5-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.5-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Fri Dec 14 2018 Paul Wouters <pwouters@redhat.com> - 1.4.5-2
+- Disable hardened build to really fix rhbz#1413408
+
+* Mon Dec 10 2018 Paul Wouters <pwouters@redhat.com> - 1.4.5-1
+- Resolves: rhbz#1574091 conntrack-tools-1.4.5 is available
+- Resolves: rhbz#1413408 ct_helper_ftp not working
+  (I've reduced the hardening to use -z,lazy)
+- Eanbled systemd support
+- Bumped required libnetfilter_conntrack-devel to 1.0.7
+- fixup harmless but broken mkdir in spec file
+- Don't override CPPFLAGS and LIBS, instead fixup src/helpers/Makefile
+
+* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.4-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Thu Apr 12 2018 Orion Poplawski <orion@nwra.com> - 1.4.4-7
+- Use libtirpc
+- Use %%license
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.4-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.4-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.4-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Wed Feb 22 2017 Paul Wouters <pwouters@redhat.com> - 1.4.4-3
+- Add upstream patches (free pktb after use, nat_tuple leak)
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Thu Sep 22 2016 Paul Wouters <pwouters@redhat.com> - 1.4.4-1
+- Updated to 1.4.4 (rhbz#1370668)
+- Include new man5 pages
+
+* Wed Apr 20 2016 Paul Wouters <pwouters@redhat.com> - 1.4.3-1
+- Resolves: rhbz#1261220 1.4.3 is available
+- Update source url
+- Remove incorporated patches
+
+* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.2-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Fri Aug 21 2015 Paul Wouters <pwouters@redhat.com> - 1.4.2-10
+- Resolves: 1255578 - conntrackd could neither be started nor be stopped
+
+* Tue Aug 18 2015 Paul Wouters <pwouters@redhat.com> - 1.4.2-9
+- Resolves: rhbz#CVE-2015-6496, rhbz#1253757
+- Fold in upstream patches since 1.4.2 release up to git 900d7e8
+- Fold in upstream patch set of 2015-08-18 for coverity issues
+
+* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.2-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Mon Jan 12 2015 Paul Komkoff <i@stingr.net> - 1.4.2-7
+- bz#1181119 - wait for network to be on before starting conntrackd
+
+* Sun Jan 11 2015 Paul Komkoff <i@stingr.net> - 1.4.2-6
+- bz#998105 - remove patch residues from doc
+
+* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.2-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.2-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Sat Dec 21 2013 Paul Komkoff <i@stingr.net> - 1.4.2-3
+- rebuilt
+
+* Sat Sep  7 2013 Paul P. Komkoff Jr <i@stingr.net> - 1.4.2-2
+- bz#850067
+
+* Sat Sep  7 2013 Paul P. Komkoff Jr <i@stingr.net> - 1.4.2-1
+- new upstream version
+
+* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Fri Feb 08 2013 Paul Komkoff <i@stingr.net> - 1.4.0-2
+- fix bz#909128
+
+* Mon Nov 26 2012 Paul P. Komkoff Jr <i@stingr.net> - 1.4.0-1
+- new upstream version
+
+* Tue Jul 24 2012 Paul P. Komkoff Jr <i@stingr.net> - 1.2.1
+- new upstream version
+
+* Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Mon May 07 2012 Paul Wouters <pwouters@redhat.com> - 1.0.1-1
+- Updated to 1.0.1
+- Added daemon using systemd and configuration file
+- Removed legacy spec requirements
+- Patch for: parse.c:240:34: error: 'NULL' undeclared 
+
+* Thu Jan 12 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
+
+* Thu May  5 2011 Paul P. Komkoff Jr <i@stingr.net> - 1.0.0
+- new upstream version
+
+* Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.15-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
+* Fri Nov 19 2010 Paul P. Komkoff Jr <i@stingr.net> - 0.9.15-1
+- new upstream version
+
+* Thu Mar 25 2010 Paul P. Komkoff Jr <i@stingr.net> - 0.9.14-1
+- update, at last
+
+* Tue Nov 10 2009 Paul P. Komkoff Jr <i@stingr.net> - 0.9.13-2
+- failed to properly commit the package :(
+
+* Tue Oct 13 2009 Paul P. Komkoff Jr <i@stingr.net> - 0.9.13-1
+- new upstream version
+
+* Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.12-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
+* Sun May 24 2009 Paul P. Komkoff Jr <i@stingr.net> - 0.9.12-3
+- new upstream version
+
+* Sun May 24 2009 Paul P. Komkoff Jr <i@stingr.net> - 0.9.12-2
+- versioning screwup
+
+* Sun May 24 2009 Paul P. Komkoff Jr <i@stingr.net> - 0.9.12-1
+- new upstream version
+
+* Tue Feb 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9.9-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
+
+* Tue Jan 13 2009 Paul P. Komkoff Jr <i@stingr.net> - 0.9.9-1
+- new upstream version
+
+* Sun Oct 26 2008 Paul P. Komkoff Jr <i@stingr.net> - 0.9.8-1
+- new upstream version
+- remove rollup patch
+
+* Wed Jul 16 2008 Paul P. Komkoff Jr <i@stingr.net> - 0.9.7-2
+- fix Patch0/%%patch.
+
+* Wed Jul 16 2008 Paul P. Komkoff Jr <i@stingr.net> - 0.9.7-1
+- new upstream version
+
+* Sat Feb 23 2008 Paul P. Komkoff Jr <i@stingr.net> - 0.9.6-0.1.svn7382
+- new version from svn
+
+* Fri Feb 22 2008 Paul P. Komkoff Jr <i@stingr.net> - 0.9.5-5
+- fix the PATH_MAX-related compilation problem
+
+* Tue Feb 19 2008 Fedora Release Engineering <rel-eng@fedoraproject.org> - 0.9.5-4
+- Autorebuild for GCC 4.3
+
+* Tue Oct 23 2007 Paul P. Komkoff Jr <i@stingr.net> - 0.9.5-3
+- review fixes
+
+* Sun Oct 21 2007 Paul P. Komkoff Jr <i@stingr.net> - 0.9.5-2
+- review fixes
+
+* Fri Oct 19 2007 Paul P. Komkoff Jr <i@stingr.net> - 0.9.5-1
+- new upstream version
+
+* Sun Jul 22 2007 Paul P. Komkoff Jr <i@stingr.net> - 0.9.4-1
+- replace conntrack with conntrack-tools

conntrackd.conf

@@ -0,0 +1,419 @@
+
+# See also: http://conntrack-tools.netfilter.org/support.html
+# 
+# There are 3 different modes of running conntrackd: "alarm", "notrack" and "ftfw"
+#
+# The default package ships with a FTFW configuration, see /usr/share/doc/conntrackd*
+# for example configurations for other modes.
+
+
+#
+# Synchronizer settings
+#
+Sync {
+	Mode FTFW {
+		#
+		# Size of the resend queue (in objects). This is the maximum
+		# number of objects that can be stored waiting to be confirmed
+		# via acknoledgment. If you keep this value low, the daemon
+		# will have less chances to recover state-changes under message
+		# omission. On the other hand, if you keep this value high,
+		# the daemon will consume more memory to store dead objects.
+		# Default is 131072 objects.
+		#
+		# ResendQueueSize 131072
+
+		#
+		# This parameter allows you to set an initial fixed timeout
+		# for the committed entries when this node goes from backup
+		# to primary. This mechanism provides a way to purge entries
+		# that were not recovered appropriately after the specified
+		# fixed timeout. If you set a low value, TCP entries in
+		# Established states with no traffic may hang. For example,
+		# an SSH connection without KeepAlive enabled. If not set,
+		# the daemon uses an approximate timeout value calculation
+		# mechanism. By default, this option is not set.
+		#
+		# CommitTimeout 180
+
+		#
+		# If the firewall replica goes from primary to backup,
+		# the conntrackd -t command is invoked in the script. 
+		# This command schedules a flush of the table in N seconds.
+		# This is useful to purge the connection tracking table of
+		# zombie entries and avoid clashes with old entries if you
+		# trigger several consecutive hand-overs. Default is 60 seconds.
+		#
+		# PurgeTimeout 60
+
+		# Set the acknowledgement window size. If you decrease this
+		# value, the number of acknowlegdments increases. More
+		# acknowledgments means more overhead as conntrackd has to
+		# handle more control messages. On the other hand, if you
+		# increase this value, the resend queue gets more populated.
+		# This results in more overhead in the queue releasing.
+		# The following value is based on some practical experiments
+		# measuring the cycles spent by the acknowledgment handling
+		# with oprofile. If not set, default window size is 300.
+		#
+		# ACKWindowSize 300
+
+		#
+		# This clause allows you to disable the external cache. Thus,
+		# the state entries are directly injected into the kernel
+		# conntrack table. As a result, you save memory in user-space
+		# but you consume slots in the kernel conntrack table for
+		# backup state entries. Moreover, disabling the external cache
+		# means more CPU consumption. You need a Linux kernel
+		# >= 2.6.29 to use this feature. By default, this clause is
+		# set off. If you are installing conntrackd for first time,
+		# please read the user manual and I encourage you to consider
+		# using the fail-over scripts instead of enabling this option!
+		#
+		# DisableExternalCache Off
+	}
+
+	#
+	# Multicast IP and interface where messages are
+	# broadcasted (dedicated link). IMPORTANT: Make sure
+	# that iptables accepts traffic for destination
+	# 225.0.0.50, eg:
+	#
+	#	iptables -I INPUT -d 225.0.0.50 -j ACCEPT
+	#	iptables -I OUTPUT -d 225.0.0.50 -j ACCEPT
+	#
+	Multicast {
+		# 
+		# Multicast address: The address that you use as destination
+		# in the synchronization messages. You do not have to add
+		# this IP to any of your existing interfaces. If any doubt,
+		# do not modify this value.
+		#
+		IPv4_address 225.0.0.50
+
+		#
+		# The multicast group that identifies the cluster. If any
+		# doubt, do not modify this value.
+		#
+		Group 3780
+
+		#
+		# IP address of the interface that you are going to use to
+		# send the synchronization messages. Remember that you must
+		# use a dedicated link for the synchronization messages.
+		#
+		IPv4_interface 192.168.100.100
+
+		#
+		# The name of the interface that you are going to use to
+		# send the synchronization messages.
+		#
+		Interface eth2
+
+		# The multicast sender uses a buffer to enqueue the packets
+		# that are going to be transmitted. The default size of this
+		# socket buffer is available at /proc/sys/net/core/wmem_default.
+		# This value determines the chances to have an overrun in the
+		# sender queue. The overrun results packet loss, thus, losing
+		# state information that would have to be retransmitted. If you
+		# notice some packet loss, you may want to increase the size
+		# of the sender buffer. The default size is usually around
+		# ~100 KBytes which is fairly small for busy firewalls.
+		#
+		SndSocketBuffer 1249280
+
+		# The multicast receiver uses a buffer to enqueue the packets
+		# that the socket is pending to handle. The default size of this
+		# socket buffer is available at /proc/sys/net/core/rmem_default.
+		# This value determines the chances to have an overrun in the
+		# receiver queue. The overrun results packet loss, thus, losing
+		# state information that would have to be retransmitted. If you
+		# notice some packet loss, you may want to increase the size of
+		# the receiver buffer. The default size is usually around
+		# ~100 KBytes which is fairly small for busy firewalls.
+		#
+		RcvSocketBuffer 1249280
+
+		# 
+		# Enable/Disable message checksumming. This is a good
+		# property to achieve fault-tolerance. In case of doubt, do
+		# not modify this value.
+		#
+		Checksum on
+	}
+	#
+	# You can specify more than one dedicated link. Thus, if one dedicated
+	# link fails, conntrackd can fail-over to another. Note that adding
+	# more than one dedicated link does not mean that state-updates will
+	# be sent to all of them. There is only one active dedicated link at
+	# a given moment. The `Default' keyword indicates that this interface
+	# will be selected as the initial dedicated link. You can have 
+	# up to 4 redundant dedicated links. Note: Use different multicast 
+	# groups for every redundant link.
+	#
+	# Multicast Default {
+	#	IPv4_address 225.0.0.51
+	#	Group 3781
+	#	IPv4_interface 192.168.100.101
+	#	Interface eth3
+	#	# SndSocketBuffer 1249280
+	#	# RcvSocketBuffer 1249280
+	#	Checksum on
+	# }
+
+	#
+	# You can use Unicast UDP instead of Multicast to propagate events.
+	# Note that you cannot use unicast UDP and Multicast at the same
+	# time, you can only select one.
+	# 
+	# UDP {
+		# 
+		# UDP address that this firewall uses to listen to events.
+		#
+		# IPv4_address 192.168.2.100
+		#
+		# or you may want to use an IPv6 address:
+		#
+		# IPv6_address fe80::215:58ff:fe28:5a27
+
+		#
+		# Destination UDP address that receives events, ie. the other
+		# firewall's dedicated link address.
+		#
+		# IPv4_Destination_Address 192.168.2.101
+		#
+		# or you may want to use an IPv6 address:
+		#
+		# IPv6_Destination_Address fe80::2d0:59ff:fe2a:775c
+
+		#
+		# UDP port used
+		#
+		# Port 3780
+
+		#
+		# The name of the interface that you are going to use to
+		# send the synchronization messages.
+		#
+		# Interface eth2
+
+		# 
+		# The sender socket buffer size
+		#
+		# SndSocketBuffer 1249280
+
+		#
+		# The receiver socket buffer size
+		#
+		# RcvSocketBuffer 1249280
+
+		# 
+		# Enable/Disable message checksumming. 
+		#
+		# Checksum on
+	# }
+
+	# 
+	# Other unsorted options that are related to the synchronization.
+	# 
+	# Options {
+		#
+		# TCP state-entries have window tracking disabled by default,
+		# you can enable it with this option. As said, default is off.
+		# This feature requires a Linux kernel >= 2.6.36.
+		#
+		# TCPWindowTracking Off
+	# }
+}
+
+#
+# General settings
+#
+General {
+	#
+	# Set the nice value of the daemon, this value goes from -20
+	# (most favorable scheduling) to 19 (least favorable). Using a
+	# very low value reduces the chances to lose state-change events.
+	# Default is 0 but this example file sets it to most favourable
+	# scheduling as this is generally a good idea. See man nice(1) for
+	# more information.
+	#
+	Nice -20
+
+	#
+	# Select a different scheduler for the daemon, you can select between
+	# RR and FIFO and the process priority (minimum is 0, maximum is 99).
+	# See man sched_setscheduler(2) for more information. Using a RT
+	# scheduler reduces the chances to overrun the Netlink buffer.
+	#
+	# Scheduler {
+	#	Type FIFO
+	#	Priority 99
+	# }
+
+	#
+	# Number of buckets in the cache hashtable. The bigger it is,
+	# the closer it gets to O(1) at the cost of consuming more memory.
+	# Read some documents about tuning hashtables for further reference.
+	#
+	HashSize 32768
+
+	#
+	# Maximum number of conntracks, it should be double of: 
+	# $ cat /proc/sys/net/netfilter/nf_conntrack_max
+	# since the daemon may keep some dead entries cached for possible
+	# retransmission during state synchronization.
+	#
+	HashLimit 131072
+
+	#
+	# Logfile: on (/var/log/conntrackd.log), off, or a filename
+	# Default: off
+	#
+	LogFile on
+
+	#
+	# Syslog: on, off or a facility name (daemon (default) or local0..7)
+	# Default: off
+	#
+	#Syslog on
+
+	#
+	# Lockfile
+	# 
+	LockFile /var/lock/conntrack.lock
+
+	#
+	# Unix socket configuration
+	#
+	UNIX {
+		Path /var/run/conntrackd.ctl
+		Backlog 20
+	}
+
+	#
+	# Netlink event socket buffer size. If you do not specify this clause,
+	# the default buffer size value in /proc/net/core/rmem_default is
+	# used. This default value is usually around 100 Kbytes which is
+	# fairly small for busy firewalls. This leads to event message dropping
+	# and high CPU consumption. This example configuration file sets the
+	# size to 2 MBytes to avoid this sort of problems.
+	#
+	NetlinkBufferSize 2097152
+
+	#
+	# The daemon doubles the size of the netlink event socket buffer size
+	# if it detects netlink event message dropping. This clause sets the
+	# maximum buffer size growth that can be reached. This example file
+	# sets the size to 8 MBytes.
+	#
+	NetlinkBufferSizeMaxGrowth 8388608
+
+	#
+	# If the daemon detects that Netlink is dropping state-change events,
+	# it automatically schedules a resynchronization against the Kernel
+	# after 30 seconds (default value). Resynchronizations are expensive
+	# in terms of CPU consumption since the daemon has to get the full
+	# kernel state-table and purge state-entries that do not exist anymore.
+	# Be careful of setting a very small value here. You have the following
+	# choices: On (enabled, use default 30 seconds value), Off (disabled)
+	# or Value (in seconds, to set a specific amount of time). If not
+	# specified, the daemon assumes that this option is enabled.
+	#
+	# NetlinkOverrunResync On
+
+	#
+	# If you want reliable event reporting over Netlink, set on this
+	# option. If you set on this clause, it is a good idea to set off
+	# NetlinkOverrunResync. This option is off by default and you need
+	# a Linux kernel >= 2.6.31.
+	#
+	# NetlinkEventsReliable Off
+
+	# 
+	# By default, the daemon receives state updates following an
+	# event-driven model. You can modify this behaviour by switching to
+	# polling mode with the PollSecs clause. This clause tells conntrackd
+	# to dump the states in the kernel every N seconds. With regards to
+	# synchronization mode, the polling mode can only guarantee that
+	# long-lifetime states are recovered. The main advantage of this method
+	# is the reduction in the state replication at the cost of reducing the
+	# chances of recovering connections.
+	#
+	# PollSecs 15
+
+	#
+	# The daemon prioritizes the handling of state-change events coming
+	# from the core. With this clause, you can set the maximum number of
+	# state-change events (those coming from kernel-space) that the daemon
+	# will handle after which it will handle other events coming from the
+	# network or userspace. A low value improves interactivity (in terms of
+	# real-time behaviour) at the cost of extra CPU consumption.
+	# Default (if not set) is 100.
+	#
+	# EventIterationLimit 100
+
+	#
+	# Event filtering: This clause allows you to filter certain traffic,
+	# There are currently three filter-sets: Protocol, Address and
+	# State. The filter is attached to an action that can be: Accept or
+	# Ignore. Thus, you can define the event filtering policy of the
+	# filter-sets in positive or negative logic depending on your needs.
+	# You can select if conntrackd filters the event messages from 
+	# user-space or kernel-space. The kernel-space event filtering
+	# saves some CPU cycles by avoiding the copy of the event message
+	# from kernel-space to user-space. The kernel-space event filtering
+	# is prefered, however, you require a Linux kernel >= 2.6.29 to
+	# filter from kernel-space. If you want to select kernel-space 
+	# event filtering, use the keyword 'Kernelspace' instead of 
+	# 'Userspace'.
+	#
+	Filter From Userspace {
+		#
+		# Accept only certain protocols: You may want to replicate
+		# the state of flows depending on their layer 4 protocol.
+		#
+		Protocol Accept {
+			TCP
+			SCTP
+			DCCP
+			# UDP
+			# ICMP # This requires a Linux kernel >= 2.6.31
+			# IPv6-ICMP # This requires a Linux kernel >= 2.6.31
+		}
+
+		#
+		# Ignore traffic for a certain set of IP's: Usually all the
+		# IP assigned to the firewall since local traffic must be
+		# ignored, only forwarded connections are worth to replicate.
+		# Note that these values depends on the local IPs that are
+		# assigned to the firewall.
+		#
+		Address Ignore {
+			IPv4_address 127.0.0.1 # loopback
+			IPv4_address 192.168.0.100 # virtual IP 1
+			IPv4_address 192.168.1.100 # virtual IP 2
+			IPv4_address 192.168.0.1
+			IPv4_address 192.168.1.1
+			IPv4_address 192.168.100.100 # dedicated link ip
+			#
+			# You can also specify networks in format IP/cidr.
+			# IPv4_address 192.168.0.0/24
+			#
+			# You can also specify an IPv6 address
+			# IPv6_address ::1
+		}
+
+		#
+		# Uncomment this line below if you want to filter by flow state.
+		# This option introduces a trade-off in the replication: it
+		# reduces CPU consumption at the cost of having lazy backup 
+		# firewall replicas. The existing TCP states are: SYN_SENT,
+		# SYN_RECV, ESTABLISHED, FIN_WAIT, CLOSE_WAIT, LAST_ACK,
+		# TIME_WAIT, CLOSED, LISTEN.
+		#
+		# State Accept {
+		#	ESTABLISHED CLOSED TIME_WAIT CLOSE_WAIT for TCP
+		# }
+	}
+}

conntrackd.init

@@ -0,0 +1,114 @@
+#!/bin/sh
+#
+# /etc/init.d/conntrackd
+#
+# Created for RHEL/Centos by: James Shubin <purpleidea@gmail.com>
+#
+### BEGIN INIT INFO
+# Provides: conntrackd
+# Required-Start: $network $syslog
+# Required-Stop: $network $syslog
+# Should-Start: $named
+# Should-Stop: $named
+# Default-Start: 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: daemon for netfilter connection tracking
+# Description: This is a daemon for replicating connection state across two
+#              machines. See http://conntrack-tools.netfilter.org/
+### END INIT INFO
+
+# the following is the chkconfig init header
+#
+# conntrackd: daemon for netfilter connection tracking
+#
+# chkconfig: 345 97 03
+# description: This is a daemon for replicating connection state across two
+#              machines. See http://conntrack-tools.netfilter.org/
+#
+# processname: conntrackd
+# pidfile: /var/run/conntrackd.pid
+#
+
+# Sanity checks
+[ -x /usr/sbin/conntrackd ] || exit 0
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+SERVICE=conntrackd
+PROCESS=conntrackd
+CONNTRACKD_CONFIG=
+CONNTRACKD_ARGS=
+
+test -f /etc/sysconfig/conntrackd && . /etc/sysconfig/conntrackd
+
+CONNTRACKD_CONFIG_ARGS=
+if [ -n "$CONNTRACKD_CONFIG" ]
+then
+	CONNTRACKD_CONFIG_ARGS="-C $CONNTRACKD_CONFIG"
+fi
+
+RETVAL=0
+
+start() {
+	echo -n $"Starting $SERVICE: "
+	# If Linux kernel is < 2.6.22, disable TCP window tracking
+	if uname -r | {
+		# version cmp courtesy of geirha in #bash
+		IFS=.- read -r a b c _; [ "$((a*10000+b*100+c))" -lt 20622 ];
+	}; then
+		echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal
+	fi
+	daemon --check $SERVICE $PROCESS -d $CONNTRACKD_CONFIG_ARGS $CONNTRACKD_ARGS
+	RETVAL=$?
+	echo
+	[ $RETVAL -eq 0 ] && touch /var/lock/subsys/$SERVICE
+}
+
+stop() {
+	echo -n $"Stopping $SERVICE: "
+	killproc $PROCESS
+	RETVAL=$?
+	echo
+	if [ $RETVAL -eq 0 ]; then
+		rm -f /var/lock/subsys/$SERVICE
+		rm -f /var/run/$SERVICE.pid
+	fi
+}
+
+restart() {
+	stop
+	start
+}
+
+# XXX: can conntrackd reload?
+reload() {
+	echo -n $"Reloading $SERVICE configuration: "
+	killproc $PROCESS -HUP
+	RETVAL=$?
+	echo
+	return $RETVAL
+}
+
+# See how we were called.
+case "$1" in
+	start|stop|restart|reload)
+		$1
+		;;
+	status)
+		status $PROCESS
+		RETVAL=$?
+		;;
+	force-reload)
+		reload
+		;;
+	condrestart|try-restart)
+		[ -f /var/lock/subsys/$SERVICE ] && restart || :
+		;;
+	*)
+		echo $"Usage: $0 {start|stop|status|restart|condrestart|reload}"
+		exit 2
+		;;
+esac
+exit $RETVAL
+

conntrackd.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=connection tracking daemon for debugging and High Availablity
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+# rhbz#1255578 daemon will not start if lock file is left dangling
+ExecStartPre=/bin/rm -f /var/lock/conntrack.lock
+ExecStart=/usr/sbin/conntrackd -C /etc/conntrackd/conntrackd.conf
+
+[Install]
+WantedBy=multi-user.target

sources

@@ -0,0 +1 @@
+SHA512 (conntrack-tools-1.4.5.tar.bz2) = 480fe2cc4420bc8477a2ba67b3d052bcb39c6b3ec000cff27fc12db70b42ec94fa3b5fe12ee35d439e88d9a631a33cd12ae470b69dde6d371d4e53af62a2eed1