Tino Keitel wrote:
> On Tue, Feb 24, 2009 at 14:47:35 +0100, Pablo Neira Ayuso wrote:
>
> [...]
>
>> It depends on the UDP traffic and your rule-set, for example, I
>> don't synchronize UDP DNS traffic but you may want to do it for
>> long-standing UDP flows for real-time communications. With regards
>
> Hi,
>
> that sounds like other UDP traffic can be synced. However, it looks
> like conntrackd does not support UDP at all. Are there plans to support
> it in upcoming releases?
Ops, it seems that I broken UDP filtering during 0.9.14. This patch
should fix it. Does it resolve the UDP support or am I missing anything
else?
conntrackd: fix UDP filtering in configuration file
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
UDP filtering was broken during the addition of the UDP-based
synchronization protocol that was introduced in 0.9.14. This
patch fixes the problem.
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
---
doc/sync/ftfw/conntrackd.conf | 1 +
src/read_config_yy.y | 19 +++++++++++++++++++
2 files changed, 20 insertions(+), 0 deletions(-)
diff --git a/doc/sync/ftfw/conntrackd.conf b/doc/sync/ftfw/conntrackd.conf
index df10aca..877ed68 100644
--- a/doc/sync/ftfw/conntrackd.conf
+++ b/doc/sync/ftfw/conntrackd.conf
@@ -357,6 +357,7 @@ General {
TCP
SCTP
DCCP
+ # UDP
# ICMP # This requires a Linux kernel >= 2.6.31
}
diff --git a/src/read_config_yy.y b/src/read_config_yy.y
index 6dfca98..5f4e6be 100644
--- a/src/read_config_yy.y
+++ b/src/read_config_yy.y
@@ -1221,6 +1221,25 @@ filter_protocol_item : T_TCP
pent->p_proto);
};
+filter_protocol_item : T_UDP
+{
+ struct protoent *pent;
+
+ pent = getprotobyname("udp");
+ if (pent == NULL) {
+ print_err(CTD_CFG_WARN, "getprotobyname() cannot find "
+ "protocol `udp' in /etc/protocols");
+ break;
+ }
+ ct_filter_add_proto(STATE(us_filter), pent->p_proto);
+
+ __kernel_filter_start();
+
+ nfct_filter_add_attr_u32(STATE(filter),
+ NFCT_FILTER_L4PROTO,
+ pent->p_proto);
+};
+
filter_item : T_ADDRESS T_ACCEPT '{' filter_address_list '}'
{
ct_filter_set_logic(STATE(us_filter),
