Per-conntrack timeout target v2
Subsystems (2)
RFC PATCH 1/1 Per-conntrack timeout target v2
This is a second attempt at a per-conntrack timeout target. As Patrick McHardy rightly observed, my previous attempt added another 4 bytes to the conntrack structure. The attached patch uses the extension infrastructure to avoid this problem.
As before, only TCP/UDP protos are supported ATM. I'm sure I've missed something in the conversion, so would appreciate any comments/review.
Phil
include/linux/netfilter/nf_conntrack_common.h +4 -0
@@ -73,6 +73,10 @@/* Connection has fixed timeout. */ IPS_FIXED_TIMEOUT_BIT =10 ,IPS_FIXED_TIMEOUT = (1 <<IPS_FIXED_TIMEOUT_BIT ), + +/* Connection has a manually configured timeout. */ +IPS_MANUAL_TIMEOUT_BIT =11 , + IPS_MANUAL_TIMEOUT = (1 << IPS_MANUAL_TIMEOUT_BIT), };/* Connection tracking event bits */
include/linux/netfilter/xt_TIMEOUT.h +17 -0
@@ -0,0 +1,17 @@ +#ifndef _XT_TIMEOUT_H +#define _XT_TIMEOUT_H + +struct nf_conn_timeout { +u_int32_t timeout; +}; + +#ifdef __KERNEL__ +#include <net/netfilter/nf_conntrack_extend.h> + +static inline struct nf_conn_timeout *nfct_timeout (const struct nf_conn *ct) +{ +return nf_ct_ext_find (ct,NF_CT_EXT_TIMEOUT ); +} +#endif + +#endif /*_XT_TIMEOUT_H*/
include/net/netfilter/nf_conntrack_extend.h +2 -0
@@ -7,11 +7,13 @@ {NF_CT_EXT_HELPER ,NF_CT_EXT_NAT , +NF_CT_EXT_TIMEOUT , NF_CT_EXT_NUM, };#define NF_CT_EXT_HELPER_TYPE struct nf_conn_help#define NF_CT_EXT_NAT_TYPE struct nf_conn_nat +#define NF_CT_EXT_TIMEOUT_TYPE struct nf_conn_timeout/* Extensions: optional stuff which isn't permanently in struct. */ struct nf_ct_ext {
net/netfilter/Kconfig +11 -0
@@ -365,6 +365,17 @@ If you want to compile it as a module, say M here and read <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. +config NETFILTER_XT_TARGET_TIMEOUT + tristate '"TIMEOUT" target support' + depends on NETFILTER_XTABLES + depends on NF_CONNTRACK + help + The TIMEOUT target allows you to alter the timeout of specific + sessions in the conntrack/NAT subsystem. Specific conntracks can + be given longer or shorter timeouts than the global defaults. + + If unsure, say `N'. + config NETFILTER_XT_TARGET_SECMARK tristate '"SECMARK" target support' depends on NETFILTER_XTABLES && NETWORK_SECMARK
net/netfilter/Makefile +1 -0
@@ -48,6 +48,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o obj-$(CONFIG_NETFILTER_XT_TARGET_TCPMSS) += xt_TCPMSS.o +obj-$(CONFIG_NETFILTER_XT_TARGET_TIMEOUT) += xt_TIMEOUT.o obj-$(CONFIG_NETFILTER_XT_TARGET_TRACE) += xt_TRACE.o # matches
net/netfilter/nf_conntrack_proto_tcp.c +4 -0
@@ -24,6 +24,7 @@#include <net/netfilter/nf_conntrack.h> #include <net/netfilter/nf_conntrack_l4proto.h> #include <net/netfilter/nf_conntrack_ecache.h> +#include <linux/netfilter/xt_TIMEOUT.h> /* Protects conntrack->proto.tcp */ static DEFINE_RWLOCK (tcp_lock);
@@ -944,6 +945,9 @@ timeout = conntrack->proto.tcp.retrans >= nf_ct_tcp_max_retrans && *tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans ? nf_ct_tcp_timeout_max_retrans : *tcp_timeouts[new_state]; +if (test_bit (IPS_MANUAL_TIMEOUT_BIT , &conntrack->status) + && new_state ==TCP_CONNTRACK_ESTABLISHED ) + timeout =nfct_timeout (conntrack)->timeout;write_unlock_bh (&tcp_lock);nf_conntrack_event_cache (IPCT_PROTOINFO_VOLATILE , skb);
net/netfilter/nf_conntrack_proto_udp.c +7 -1
@@ -21,6 +21,7 @@#include <linux/netfilter_ipv6.h> #include <net/netfilter/nf_conntrack_l4proto.h> #include <net/netfilter/nf_conntrack_ecache.h> +#include <linux/netfilter/xt_TIMEOUT.h> static unsigned int nf_ct_udp_timeout__read_mostly =30 *HZ ;static unsigned int nf_ct_udp_timeout_stream__read_mostly =180 *HZ ;
@@ -74,11 +75,16 @@ int pf, unsigned int hooknum) { +unsigned long timeout; +/* If we've seen traffic both ways, this is some kind of UDP stream. Extend timeout. */ if (test_bit (IPS_SEEN_REPLY_BIT , &conntrack->status)) { + timeout = nf_ct_udp_timeout_stream; +if (test_bit (IPS_MANUAL_TIMEOUT_BIT , &conntrack->status)) + timeout =nfct_timeout (conntrack)->timeout;nf_ct_refresh_acct (conntrack, ctinfo, skb, - nf_ct_udp_timeout_stream); + timeout);/* Also, more likely to be important, and not a probe */ if (!test_and_set_bit (IPS_ASSURED_BIT , &conntrack->status))nf_conntrack_event_cache (IPCT_STATUS , skb);
net/netfilter/xt_TIMEOUT.c +121 -0
121 lines not on this page · raw message
extensions/libxt_TIMEOUT.c +111 -0
111 lines not on this page · raw message
extensions/Makefile +1 -1
@@ -7,7 +7,7 @@ # PF_EXT_SLIB:=ah addrtype conntrack ecn icmp iprange owner policy realm recent tos ttl unclean CLUSTERIP DNAT ECN LOG MASQUERADE MIRROR NETMAP REDIRECT REJECT SAME SNAT TOS TTL ULOG PF6_EXT_SLIB:=ah dst eui64 frag hbh hl icmp6 ipv6header mh owner policy rt HL LOG REJECT -PFX_EXT_SLIB:=connbytes connmark connlimit comment dccp dscp esp hashlimit helper length limit mac mark multiport physdev pkttype quota sctp state statistic standard string tcp tcpmss time u32 udp CLASSIFY CONNMARK DSCP MARK NFLOG NFQUEUE NOTRACK TCPMSS TRACE +PFX_EXT_SLIB:=connbytes connmark connlimit comment dccp dscp esp hashlimit helper length limit mac mark multiport physdev pkttype quota sctp state statistic standard string tcp tcpmss time u32 udp CLASSIFY CONNMARK DSCP MARK NFLOG NFQUEUE NOTRACK TCPMSS TRACE TIMEOUT PF_EXT_SELINUX_SLIB:= PF6_EXT_SELINUX_SLIB:=
include/linux/netfilter/xt_TIMEOUT.h +17 -0
@@ -0,0 +1,17 @@ +#ifndef _XT_TIMEOUT_H +#define _XT_TIMEOUT_H + +struct nf_conn_timeout { +u_int32_t timeout; +}; + +#ifdef __KERNEL__ +#include <net/netfilter/nf_conntrack_extend.h> + +static inline struct nf_conn_timeout *nfct_timeout (const struct nf_conn *ct) +{ +return nf_ct_ext_find (ct,NF_CT_EXT_TIMEOUT ); +} +#endif + +#endif /*_XT_TIMEOUT_H*/