Per-conntrack timeout target
Subsystems (2)
RFC 1/1 Per-conntrack timeout target
I use a fairly short 2 hour established timeout on firewalls I operate, which works fine for most purposes. Occasionally, however, it would be nice to have a longer timeout for *certain* types of traffic such as SSH or telnet sessions.
So, below find a TIMEOUT target to enable such per-conntrack timeouts. Syntax for SSH would be something like:
iptables -A foo -p tcp --dport 22 -j TIMEOUT --timeout 123456
iptables -A foo -p tcp --dport 22 -j ACCEPTIt could of course also be used to lower the timeouts on some traffic, such as HTTP.
Please review, comment, criticize, etc. Note that at present it only handles TCP/UDP traffic. If deemed "merge-worthy", support for other protos will be added.
Phil
include/linux/netfilter/xt_TIMEOUT.h +8 -0
@@ -0,0 +1,8 @@ +#ifndef _XT_TIMEOUT_H +#define _XT_TIMEOUT_H + +struct xt_timeout_info { +u_int32_t timeout; +}; + +#endif /*_XT_TIMEOUT_H*/
include/net/netfilter/nf_conntrack.h +4 -0
@@ -124,6 +124,10 @@u_int32_t secmark;#endif +#ifdef CONFIG_NF_CONNTRACK_TIMEOUT +u_int32_t xt_target_timeout; +#endif +/* Storage reserved for other modules: */ union nf_conntrack_proto proto;
net/netfilter/Kconfig +23 -0
@@ -87,6 +87,17 @@ If unsure, say `N'. +config NF_CONNTRACK_TIMEOUT + bool 'Connection tracking timeouts' + depends on NF_CONNTRACK + help + This option enables support for per-conntrack timeouts. When used + with the TIMEOUT target, specific conntracks can be given shorter or + longer timeouts. This provides more flexibility than altering + the global timeouts. + + If unsure, say `N'. + config NF_CT_PROTO_GRE tristate depends on NF_CONNTRACK
@@ -365,6 +376,18 @@ If you want to compile it as a module, say M here and read <file:Documentation/kbuild/modules.txt>. If unsure, say `N'. +config NETFILTER_XT_TARGET_TIMEOUT + tristate '"TIMEOUT" target support' + depends on NETFILTER_XTABLES + depends on NF_CONNTRACK + depends on NF_CONNTRACK_TIMEOUT + help + The TIMEOUT target allows you to alter the timeout of sessions + in the conntrack/NAT subsystem. This provides more flexibility + than altering the global timeouts. + + If unsure, say `N'. + config NETFILTER_XT_TARGET_SECMARK tristate '"SECMARK" target support' depends on NETFILTER_XTABLES && NETWORK_SECMARK
net/netfilter/Makefile +1 -0
@@ -45,6 +45,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE) += xt_NFQUEUE.o obj-$(CONFIG_NETFILTER_XT_TARGET_NFLOG) += xt_NFLOG.o obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o +obj-$(CONFIG_NETFILTER_XT_TARGET_TIMEOUT) += xt_TIMEOUT.o obj-$(CONFIG_NETFILTER_XT_TARGET_TRACE) += xt_TRACE.o obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o obj-$(CONFIG_NETFILTER_XT_TARGET_TCPMSS) += xt_TCPMSS.o
net/netfilter/nf_conntrack_core.c +3 -0
@@ -544,6 +544,9 @@#ifdef CONFIG_NF_CONNTRACK_SECMARK conntrack->secmark = exp->master->secmark;#endif +#ifdef CONFIG_NF_CONNTRACK_TIMEOUT + conntrack->xt_target_timeout = exp->master->xt_target_timeout; +#endif nf_conntrack_get (&conntrack->master->ct_general);NF_CT_STAT_INC (expect_new); }else {
net/netfilter/nf_conntrack_proto_tcp.c +5 -0
@@ -944,6 +944,11 @@ timeout = conntrack->proto.tcp.retrans >= nf_ct_tcp_max_retrans && *tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans ? nf_ct_tcp_timeout_max_retrans : *tcp_timeouts[new_state]; +#ifdef CONFIG_NF_CONNTRACK_TIMEOUT +if (conntrack->xt_target_timeout + && new_state ==TCP_CONNTRACK_ESTABLISHED ) + timeout = conntrack->xt_target_timeout; +#endif write_unlock_bh (&tcp_lock);nf_conntrack_event_cache (IPCT_PROTOINFO_VOLATILE , skb);
net/netfilter/nf_conntrack_proto_udp.c +8 -1
@@ -74,11 +74,18 @@ int pf, unsigned int hooknum) { +unsigned long timeout; +/* If we've seen traffic both ways, this is some kind of UDP stream. Extend timeout. */ if (test_bit (IPS_SEEN_REPLY_BIT , &conntrack->status)) { + timeout = nf_ct_udp_timeout_stream; +#ifdef CONFIG_NF_CONNTRACK_TIMEOUT +if (conntrack->xt_target_timeout) + timeout = conntrack->xt_target_timeout; +#endif nf_ct_refresh_acct (conntrack, ctinfo, skb, - nf_ct_udp_timeout_stream); + timeout);/* Also, more likely to be important, and not a probe */ if (!test_and_set_bit (IPS_ASSURED_BIT , &conntrack->status))nf_conntrack_event_cache (IPCT_STATUS , skb);
net/netfilter/xt_TIMEOUT.c +92 -0
92 lines not on this page · raw message
extensions/libxt_TIMEOUT.c +111 -0
111 lines not on this page · raw message
extensions/Makefile +1 -1
@@ -7,7 +7,7 @@ # PF_EXT_SLIB:=ah addrtype conntrack ecn icmp iprange owner policy realm recent tos ttl unclean CLUSTERIP DNAT ECN LOG MASQUERADE MIRROR NETMAP REDIRECT REJECT SAME SNAT TOS TTL ULOG PF6_EXT_SLIB:=ah dst eui64 frag hbh hl icmp6 ipv6header mh owner policy rt HL LOG REJECT -PFX_EXT_SLIB:=connbytes connmark connlimit comment dccp dscp esp hashlimit helper length limit mac mark multiport physdev pkttype quota sctp state statistic standard string tcp tcpmss time u32 udp CLASSIFY CONNMARK DSCP MARK NFLOG NFQUEUE NOTRACK TCPMSS TRACE +PFX_EXT_SLIB:=connbytes connmark connlimit comment dccp dscp esp hashlimit helper length limit mac mark multiport physdev pkttype quota sctp state statistic standard string tcp tcpmss time u32 udp CLASSIFY CONNMARK DSCP MARK NFLOG NFQUEUE NOTRACK TCPMSS TRACE TIMEOUT PF_EXT_SELINUX_SLIB:= PF6_EXT_SELINUX_SLIB:=
include/linux/netfilter/xt_TIMEOUT.h +8 -0
@@ -0,0 +1,8 @@ +#ifndef _XT_TIMEOUT_H +#define _XT_TIMEOUT_H + +struct xt_timeout_info { +u_int32_t timeout; +}; + +#endif /*_XT_TIMEOUT_H*/
Quoted 11 lines · Phil Oester
I use a fairly short 2 hour established timeout on firewalls I operate, which works fine for most purposes. Occasionally, however, it would be nice to have a longer timeout for *certain* types of traffic such as SSH or telnet sessions.
So, below find a TIMEOUT target to enable such per-conntrack timeouts. Syntax for SSH would be something like:
iptables -A foo -p tcp --dport 22 -j TIMEOUT --timeout 123456 iptables -A foo -p tcp --dport 22 -j ACCEPT
Quoted 6 lines
It could of course also be used to lower the timeouts on some traffic, such as HTTP.
Please review, comment, criticize, etc. Note that at present it only handles TCP/UDP traffic. If deemed "merge-worthy", support for other protos will be added.
The only downside I see is that it adds another 4 bytes to the conntrack structure and distributions are probably going to enable it, like everything else. It would be nice if we could put this in a ct_extend structure, but that would mean you're only able to set it for new connections. What do you think about this?
Quoted 3 lines · Patrick McHardy
The only downside I see is that it adds another 4 bytes to the conntrack structure and distributions are probably going to enable it, like everything else.
Yep, that's a problem.
Quoted 3 lines
It would be nice if we could put this in a
ct_extendstructure, but that would mean you're only able to set it for new connections. What do you think about this?
Complicates my life, but is the Right Thing. I'll work on this. Should we be considering the same for mark/secmark?
Phil
Quoted 5 lines · Phil Oester
Quoted 3 lines · Patrick McHardy
The only downside I see is that it adds another 4 bytes to the conntrack structure and distributions are probably going to enable it, like everything else.
Quoted 8 lines
Yep, that's a problem.
Quoted 3 lines
It would be nice if we could put this in a
ct_extendstructure, but that would mean you're only able to set it for new connections. What do you think about this?Complicates my life, but is the Right Thing. I'll work on this. Should we be considering the same for mark/secmark?
That would be incompatible to todays behaviour, so I think no. We could of course consider making ct_extend work for confirmed conntracks, for thats a lot more complicated without adding extra locking everywhere :) What would work though is to specify which connections will have manually managed timeouts while they're unconfirmed (either through a target or by registering a prealloc type, so we allocate accordingly), and only allow to change the settings of confirmed connections.