netfilter: nf_ct_udp[lite]: convert UDP[lite] timeouts to array (5a41db94) · Commits · 戴 / test

net/netfilter/nf_conntrack_proto_udp.c

+20 −10

Original line number	Diff line number	Diff line
		@@ -25,8 +25,16 @@
		#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
		#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>

		static unsigned int nf_ct_udp_timeout __read_mostly = 30*HZ;
		static unsigned int nf_ct_udp_timeout_stream __read_mostly = 180*HZ;
		enum udp_conntrack {
		UDP_CT_UNREPLIED,
		UDP_CT_REPLIED,
		UDP_CT_MAX
		};

		static unsigned int udp_timeouts[UDP_CT_MAX] = {
		[UDP_CT_UNREPLIED] = 30*HZ,
		[UDP_CT_REPLIED] = 180*HZ,
		};

		static bool udp_pkt_to_tuple(const struct sk_buff *skb,
		unsigned int dataoff,
		@@ -74,13 +82,15 @@ static int udp_packet(struct nf_conn *ct,
		/* If we've seen traffic both ways, this is some kind of UDP
		stream. Extend timeout. */
		if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
		nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout_stream);
		nf_ct_refresh_acct(ct, ctinfo, skb,
		udp_timeouts[UDP_CT_REPLIED]);
		/* Also, more likely to be important, and not a probe */
		if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
		nf_conntrack_event_cache(IPCT_ASSURED, ct);
		} else
		nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout);

		} else {
		nf_ct_refresh_acct(ct, ctinfo, skb,
		udp_timeouts[UDP_CT_UNREPLIED]);
		}
		return NF_ACCEPT;
		}

		@@ -142,14 +152,14 @@ static struct ctl_table_header *udp_sysctl_header;
		static struct ctl_table udp_sysctl_table[] = {
		{
		.procname = "nf_conntrack_udp_timeout",
		.data = &nf_ct_udp_timeout,
		.data = &udp_timeouts[UDP_CT_UNREPLIED],
		.maxlen = sizeof(unsigned int),
		.mode = 0644,
		.proc_handler = proc_dointvec_jiffies,
		},
		{
		.procname = "nf_conntrack_udp_timeout_stream",
		.data = &nf_ct_udp_timeout_stream,
		.data = &udp_timeouts[UDP_CT_REPLIED],
		.maxlen = sizeof(unsigned int),
		.mode = 0644,
		.proc_handler = proc_dointvec_jiffies,
		@@ -160,14 +170,14 @@ static struct ctl_table udp_sysctl_table[] = {
		static struct ctl_table udp_compat_sysctl_table[] = {
		{
		.procname = "ip_conntrack_udp_timeout",
		.data = &nf_ct_udp_timeout,
		.data = &udp_timeouts[UDP_CT_UNREPLIED],
		.maxlen = sizeof(unsigned int),
		.mode = 0644,
		.proc_handler = proc_dointvec_jiffies,
		},
		{
		.procname = "ip_conntrack_udp_timeout_stream",
		.data = &nf_ct_udp_timeout_stream,
		.data = &udp_timeouts[UDP_CT_REPLIED],
		.maxlen = sizeof(unsigned int),
		.mode = 0644,
		.proc_handler = proc_dointvec_jiffies,

net/netfilter/nf_conntrack_proto_udplite.c

+17 −8

Original line number	Diff line number	Diff line
		@@ -24,8 +24,16 @@
		#include <net/netfilter/nf_conntrack_ecache.h>
		#include <net/netfilter/nf_log.h>

		static unsigned int nf_ct_udplite_timeout __read_mostly = 30*HZ;
		static unsigned int nf_ct_udplite_timeout_stream __read_mostly = 180*HZ;
		enum udplite_conntrack {
		UDPLITE_CT_UNREPLIED,
		UDPLITE_CT_REPLIED,
		UDPLITE_CT_MAX
		};

		static unsigned int udplite_timeouts[UDPLITE_CT_MAX] = {
		[UDPLITE_CT_UNREPLIED] = 30*HZ,
		[UDPLITE_CT_REPLIED] = 180*HZ,
		};

		static bool udplite_pkt_to_tuple(const struct sk_buff *skb,
		unsigned int dataoff,
		@@ -72,13 +80,14 @@ static int udplite_packet(struct nf_conn *ct,
		stream. Extend timeout. */
		if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
		nf_ct_refresh_acct(ct, ctinfo, skb,
		nf_ct_udplite_timeout_stream);
		udplite_timeouts[UDPLITE_CT_REPLIED]);
		/* Also, more likely to be important, and not a probe */
		if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
		nf_conntrack_event_cache(IPCT_ASSURED, ct);
		} else
		nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udplite_timeout);

		} else {
		nf_ct_refresh_acct(ct, ctinfo, skb,
		udplite_timeouts[UDPLITE_CT_UNREPLIED]);
		}
		return NF_ACCEPT;
		}

		@@ -147,14 +156,14 @@ static struct ctl_table_header *udplite_sysctl_header;
		static struct ctl_table udplite_sysctl_table[] = {
		{
		.procname = "nf_conntrack_udplite_timeout",
		.data = &nf_ct_udplite_timeout,
		.data = &udplite_timeouts[UDPLITE_CT_UNREPLIED],
		.maxlen = sizeof(unsigned int),
		.mode = 0644,
		.proc_handler = proc_dointvec_jiffies,
		},
		{
		.procname = "nf_conntrack_udplite_timeout_stream",
		.data = &nf_ct_udplite_timeout_stream,
		.data = &udplite_timeouts[UDPLITE_CT_REPLIED],
		.maxlen = sizeof(unsigned int),
		.mode = 0644,
		.proc_handler = proc_dointvec_jiffies,

Admin message