mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-04 08:08:54 +00:00
netfilter: nf_ct_udp[lite]: convert UDP[lite] timeouts to array
Use one array to store the UDP timeouts instead of two variables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
3b988ece9b
commit
5a41db94c6
2 changed files with 37 additions and 18 deletions
|
@ -25,8 +25,16 @@
|
||||||
#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
|
#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
|
||||||
#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
|
#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
|
||||||
|
|
||||||
static unsigned int nf_ct_udp_timeout __read_mostly = 30*HZ;
|
enum udp_conntrack {
|
||||||
static unsigned int nf_ct_udp_timeout_stream __read_mostly = 180*HZ;
|
UDP_CT_UNREPLIED,
|
||||||
|
UDP_CT_REPLIED,
|
||||||
|
UDP_CT_MAX
|
||||||
|
};
|
||||||
|
|
||||||
|
static unsigned int udp_timeouts[UDP_CT_MAX] = {
|
||||||
|
[UDP_CT_UNREPLIED] = 30*HZ,
|
||||||
|
[UDP_CT_REPLIED] = 180*HZ,
|
||||||
|
};
|
||||||
|
|
||||||
static bool udp_pkt_to_tuple(const struct sk_buff *skb,
|
static bool udp_pkt_to_tuple(const struct sk_buff *skb,
|
||||||
unsigned int dataoff,
|
unsigned int dataoff,
|
||||||
|
@ -74,13 +82,15 @@ static int udp_packet(struct nf_conn *ct,
|
||||||
/* If we've seen traffic both ways, this is some kind of UDP
|
/* If we've seen traffic both ways, this is some kind of UDP
|
||||||
stream. Extend timeout. */
|
stream. Extend timeout. */
|
||||||
if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
|
if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
|
||||||
nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout_stream);
|
nf_ct_refresh_acct(ct, ctinfo, skb,
|
||||||
|
udp_timeouts[UDP_CT_REPLIED]);
|
||||||
/* Also, more likely to be important, and not a probe */
|
/* Also, more likely to be important, and not a probe */
|
||||||
if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
|
if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
|
||||||
nf_conntrack_event_cache(IPCT_ASSURED, ct);
|
nf_conntrack_event_cache(IPCT_ASSURED, ct);
|
||||||
} else
|
} else {
|
||||||
nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout);
|
nf_ct_refresh_acct(ct, ctinfo, skb,
|
||||||
|
udp_timeouts[UDP_CT_UNREPLIED]);
|
||||||
|
}
|
||||||
return NF_ACCEPT;
|
return NF_ACCEPT;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -142,14 +152,14 @@ static struct ctl_table_header *udp_sysctl_header;
|
||||||
static struct ctl_table udp_sysctl_table[] = {
|
static struct ctl_table udp_sysctl_table[] = {
|
||||||
{
|
{
|
||||||
.procname = "nf_conntrack_udp_timeout",
|
.procname = "nf_conntrack_udp_timeout",
|
||||||
.data = &nf_ct_udp_timeout,
|
.data = &udp_timeouts[UDP_CT_UNREPLIED],
|
||||||
.maxlen = sizeof(unsigned int),
|
.maxlen = sizeof(unsigned int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec_jiffies,
|
.proc_handler = proc_dointvec_jiffies,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.procname = "nf_conntrack_udp_timeout_stream",
|
.procname = "nf_conntrack_udp_timeout_stream",
|
||||||
.data = &nf_ct_udp_timeout_stream,
|
.data = &udp_timeouts[UDP_CT_REPLIED],
|
||||||
.maxlen = sizeof(unsigned int),
|
.maxlen = sizeof(unsigned int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec_jiffies,
|
.proc_handler = proc_dointvec_jiffies,
|
||||||
|
@ -160,14 +170,14 @@ static struct ctl_table udp_sysctl_table[] = {
|
||||||
static struct ctl_table udp_compat_sysctl_table[] = {
|
static struct ctl_table udp_compat_sysctl_table[] = {
|
||||||
{
|
{
|
||||||
.procname = "ip_conntrack_udp_timeout",
|
.procname = "ip_conntrack_udp_timeout",
|
||||||
.data = &nf_ct_udp_timeout,
|
.data = &udp_timeouts[UDP_CT_UNREPLIED],
|
||||||
.maxlen = sizeof(unsigned int),
|
.maxlen = sizeof(unsigned int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec_jiffies,
|
.proc_handler = proc_dointvec_jiffies,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.procname = "ip_conntrack_udp_timeout_stream",
|
.procname = "ip_conntrack_udp_timeout_stream",
|
||||||
.data = &nf_ct_udp_timeout_stream,
|
.data = &udp_timeouts[UDP_CT_REPLIED],
|
||||||
.maxlen = sizeof(unsigned int),
|
.maxlen = sizeof(unsigned int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec_jiffies,
|
.proc_handler = proc_dointvec_jiffies,
|
||||||
|
|
|
@ -24,8 +24,16 @@
|
||||||
#include <net/netfilter/nf_conntrack_ecache.h>
|
#include <net/netfilter/nf_conntrack_ecache.h>
|
||||||
#include <net/netfilter/nf_log.h>
|
#include <net/netfilter/nf_log.h>
|
||||||
|
|
||||||
static unsigned int nf_ct_udplite_timeout __read_mostly = 30*HZ;
|
enum udplite_conntrack {
|
||||||
static unsigned int nf_ct_udplite_timeout_stream __read_mostly = 180*HZ;
|
UDPLITE_CT_UNREPLIED,
|
||||||
|
UDPLITE_CT_REPLIED,
|
||||||
|
UDPLITE_CT_MAX
|
||||||
|
};
|
||||||
|
|
||||||
|
static unsigned int udplite_timeouts[UDPLITE_CT_MAX] = {
|
||||||
|
[UDPLITE_CT_UNREPLIED] = 30*HZ,
|
||||||
|
[UDPLITE_CT_REPLIED] = 180*HZ,
|
||||||
|
};
|
||||||
|
|
||||||
static bool udplite_pkt_to_tuple(const struct sk_buff *skb,
|
static bool udplite_pkt_to_tuple(const struct sk_buff *skb,
|
||||||
unsigned int dataoff,
|
unsigned int dataoff,
|
||||||
|
@ -72,13 +80,14 @@ static int udplite_packet(struct nf_conn *ct,
|
||||||
stream. Extend timeout. */
|
stream. Extend timeout. */
|
||||||
if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
|
if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
|
||||||
nf_ct_refresh_acct(ct, ctinfo, skb,
|
nf_ct_refresh_acct(ct, ctinfo, skb,
|
||||||
nf_ct_udplite_timeout_stream);
|
udplite_timeouts[UDPLITE_CT_REPLIED]);
|
||||||
/* Also, more likely to be important, and not a probe */
|
/* Also, more likely to be important, and not a probe */
|
||||||
if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
|
if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
|
||||||
nf_conntrack_event_cache(IPCT_ASSURED, ct);
|
nf_conntrack_event_cache(IPCT_ASSURED, ct);
|
||||||
} else
|
} else {
|
||||||
nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udplite_timeout);
|
nf_ct_refresh_acct(ct, ctinfo, skb,
|
||||||
|
udplite_timeouts[UDPLITE_CT_UNREPLIED]);
|
||||||
|
}
|
||||||
return NF_ACCEPT;
|
return NF_ACCEPT;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -147,14 +156,14 @@ static struct ctl_table_header *udplite_sysctl_header;
|
||||||
static struct ctl_table udplite_sysctl_table[] = {
|
static struct ctl_table udplite_sysctl_table[] = {
|
||||||
{
|
{
|
||||||
.procname = "nf_conntrack_udplite_timeout",
|
.procname = "nf_conntrack_udplite_timeout",
|
||||||
.data = &nf_ct_udplite_timeout,
|
.data = &udplite_timeouts[UDPLITE_CT_UNREPLIED],
|
||||||
.maxlen = sizeof(unsigned int),
|
.maxlen = sizeof(unsigned int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec_jiffies,
|
.proc_handler = proc_dointvec_jiffies,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.procname = "nf_conntrack_udplite_timeout_stream",
|
.procname = "nf_conntrack_udplite_timeout_stream",
|
||||||
.data = &nf_ct_udplite_timeout_stream,
|
.data = &udplite_timeouts[UDPLITE_CT_REPLIED],
|
||||||
.maxlen = sizeof(unsigned int),
|
.maxlen = sizeof(unsigned int),
|
||||||
.mode = 0644,
|
.mode = 0644,
|
||||||
.proc_handler = proc_dointvec_jiffies,
|
.proc_handler = proc_dointvec_jiffies,
|
||||||
|
|
Loading…
Reference in a new issue