[ANNOUNCE] conntrack-tools 0.9.10 released

[Pablo Neira Ayuso <pablo@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 2732 bytes --]

Hi!

The netfilter project presents another development release of the
conntrack-tools. As usual, this release includes important fixes,
improvements and new features, mainly:

= command line interface: conntrack =

*  New option `-C': you can use it to display the number of entries in
the conntrack and expectation tables.

= userspace daemon: conntrackd =

* Internal performance improvements: important rework of the
hashtable/caching/queueing infrastructure; single output path for state
transmissions; improved event-driven architecture. See ChangeLog
attached for more details.

* Support for multi-dedicated links: you can define a pool of dedicated
links, ie. if the current dedicated link fails, another available in the
pool is selected to propagate state-changes. See the example files under
doc/ for more information.

* Extended statistics information: you can display networking, caching,
runtime and queueing statistics with `conntrackd -s [type]'. See the
manpage for more information on the statistics types.

* Polling (or batch-based) synchronization: you can configure the daemon
to send batches periodically instead of the soft real-time state
synchronization. This allows you to set up a relaxed replication while
consuming less computational resources. See `PollSecs' clause.

Q: How stable are the conntrack-tools?
A: This software is under development. Nevertheless, it has been tested
in a cluster environment composed of two stateful firewalls running
Debian 4.0 (Etch) with a Linux kernel 2.6.28, keepalived 1.1.15, using
conntrackd in FT-FW mode, randomly (in periods of 10 seconds) setting
links down to force the fail-over between the nodes. The results has
shown no hangs/closure in any TCP connection.

Q: What are the conntrack-tools?
A: The conntrack-tools are:

- The userspace daemon so-called conntrackd that covers the specific
aspects of stateful Linux firewalls to enable high availability
solutions. It can be used as statistics collector of the firewall use as
well. The daemon is highly configurable and easily extensible.

- The command line interface (CLI) conntrack that provides an interface
to add, delete and update flow entries, list current active flows in
plain text/XML, current IPv4 NAT'ed flows, reset counters, and flush the
complete connection tracking table among many other.

Q: Where can I download it from?
A: http://www.netfilter.org/projects/conntrack-tools/downloads.html

Q: Where can I get more information about them?
A: http://conntrack-tools.netfilter.org

Q: Where can I have a look at the user manual?
A: http://conntrack-tools.netfilter.org/manual.html

On behalf of the Netfilter Project,
Pablo.

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers

[-- Attachment #2: ChangeLog --]
[-- Type: text/plain, Size: 2763 bytes --]

Pablo Neira Ayuso (48):
      headers: delete unused flags in conntrackd.h
      src: add network statistics via `-s network'
      src: add cache statistics via `-s cache'
      src: add run-time statistics via `-s runtime'
      sync-mode: remove unnecessary split lines
      conntrackd: fix missing \n in conntrackd -h
      cache_iterators: display the commit time taken in the logs
      cache_iterators: add total entries available in the cache to stats
      cache: fix ENOSPC errors due to over-population of inactive entries
      filter: skip filtering by state if the event has no state info
      run: show current netlink buffer size in `-s runtime'
      netlink: don't double the netlink buffer twice during resize
      src: constify hashtable parameter in hash() callbacks
      hashtable: use calloc instead of malloc + memset
      hashtable: check NULL instead of ! for pointers
      filter: add prefix ct_filter_ to hash and compare functions
      run: limit the number of iterations over the event handling
      src: rework of the hash-cache infrastructure
      cache: add status field to store the object status
      run: relax resynchronization algorithm when netlink overruns
      sync: unify tx_list and tx_queue into one single tx_queue
      ftfw: move helloing to ftfw_xmit()
      sync: add generic tx_queue for all synchronization modes
      sync: enqueue state updates to tx_queue
      network: do not re-set the message type in nethdr_set* functions
      src: support for redundant dedicated links
      src: rename overrun handler to resync handler
      src: remove register_fds hooks
      src: add state polling support (oppossed to current event-driven)
      cache: add objects statistics
      ftfw: add ResendQueueSize and deprecate ResendBufferSize clauses
      src: add `-s queue' and change `-v' behaviour
      conntrack: add -C command to display the counter
      src: obsolete `DestroyTimeout' clause
      conntrack: fix use of -u which is optional with -I
      cache_iterators: start a clean session if commit finds an entry
      cache: remove nl_exist_conntrack() function
      cache: mangle timeout inside nl_*_conntrack() functions
      src: don't clone when calling nl_*_conntrack functions
      src: change behaviour of `-t' option
      cache: move lifetime feature to main cache code
      src: add support for approximate timeout calculation during commit
      src: increase default PurgeTimeout value
      netlink: set IP_CT_TCP_FLAG_CLOSE_INIT for TIME_WAIT states
      doc: unset CommitTimeout by default
      doc: use 'From' instead of 'from' in the example configfiles
      doc: increase hashtable bucket size and limits in example files
      configure: bump version to 0.9.10