lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: nf_ct_udp[lite]: convert UDP[lite] timeouts to array

Browse Source 
Use one array to store the UDP timeouts instead of two variables.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso
2012-02-28 02:23:28 +01:00
parent 3b988ece9b
commit 5a41db94c6
2 changed files with 37 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
net/netfilter/nf_conntrack_proto_udp.c
View File

@@ -25,8 +25,16 @@
#include <net/netfilter/ipv4/nf_conntrack_ipv4.h> #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
#include <net/netfilter/ipv6/nf_conntrack_ipv6.h> #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
static unsigned int nf_ct_udp_timeout __read_mostly = 30*HZ; enum udp_conntrack {
static unsigned int nf_ct_udp_timeout_stream __read_mostly = 180*HZ; UDP_CT_UNREPLIED,
UDP_CT_REPLIED,
UDP_CT_MAX
};
static unsigned int udp_timeouts[UDP_CT_MAX] = {
[UDP_CT_UNREPLIED] = 30*HZ,
[UDP_CT_REPLIED] = 180*HZ,
};
static bool udp_pkt_to_tuple(const struct sk_buff *skb, static bool udp_pkt_to_tuple(const struct sk_buff *skb,
unsigned int dataoff, unsigned int dataoff,
@@ -74,13 +82,15 @@ static int udp_packet(struct nf_conn *ct,
/* If we've seen traffic both ways, this is some kind of UDP /* If we've seen traffic both ways, this is some kind of UDP
stream. Extend timeout. */ stream. Extend timeout. */
if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) { if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout_stream); nf_ct_refresh_acct(ct, ctinfo, skb,
udp_timeouts[UDP_CT_REPLIED]);
/* Also, more likely to be important, and not a probe */ /* Also, more likely to be important, and not a probe */
if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status)) if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
nf_conntrack_event_cache(IPCT_ASSURED, ct); nf_conntrack_event_cache(IPCT_ASSURED, ct);
} else } else {
nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout); nf_ct_refresh_acct(ct, ctinfo, skb,
udp_timeouts[UDP_CT_UNREPLIED]);
}
return NF_ACCEPT; return NF_ACCEPT;
} }
@@ -142,14 +152,14 @@ static struct ctl_table_header *udp_sysctl_header;
static struct ctl_table udp_sysctl_table[] = { static struct ctl_table udp_sysctl_table[] = {
{ {
.procname = "nf_conntrack_udp_timeout", .procname = "nf_conntrack_udp_timeout",
.data = &nf_ct_udp_timeout, .data = &udp_timeouts[UDP_CT_UNREPLIED],
.maxlen = sizeof(unsigned int), .maxlen = sizeof(unsigned int),
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec_jiffies, .proc_handler = proc_dointvec_jiffies,
}, },
{ {
.procname = "nf_conntrack_udp_timeout_stream", .procname = "nf_conntrack_udp_timeout_stream",
.data = &nf_ct_udp_timeout_stream, .data = &udp_timeouts[UDP_CT_REPLIED],
.maxlen = sizeof(unsigned int), .maxlen = sizeof(unsigned int),
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec_jiffies, .proc_handler = proc_dointvec_jiffies,
@@ -160,14 +170,14 @@ static struct ctl_table udp_sysctl_table[] = {
static struct ctl_table udp_compat_sysctl_table[] = { static struct ctl_table udp_compat_sysctl_table[] = {
{ {
.procname = "ip_conntrack_udp_timeout", .procname = "ip_conntrack_udp_timeout",
.data = &nf_ct_udp_timeout, .data = &udp_timeouts[UDP_CT_UNREPLIED],
.maxlen = sizeof(unsigned int), .maxlen = sizeof(unsigned int),
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec_jiffies, .proc_handler = proc_dointvec_jiffies,
}, },
{ {
.procname = "ip_conntrack_udp_timeout_stream", .procname = "ip_conntrack_udp_timeout_stream",
.data = &nf_ct_udp_timeout_stream, .data = &udp_timeouts[UDP_CT_REPLIED],
.maxlen = sizeof(unsigned int), .maxlen = sizeof(unsigned int),
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec_jiffies, .proc_handler = proc_dointvec_jiffies,

25
net/netfilter/nf_conntrack_proto_udplite.c
View File

@@ -24,8 +24,16 @@
#include <net/netfilter/nf_conntrack_ecache.h> #include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_log.h> #include <net/netfilter/nf_log.h>
static unsigned int nf_ct_udplite_timeout __read_mostly = 30*HZ; enum udplite_conntrack {
static unsigned int nf_ct_udplite_timeout_stream __read_mostly = 180*HZ; UDPLITE_CT_UNREPLIED,
UDPLITE_CT_REPLIED,
UDPLITE_CT_MAX
};
static unsigned int udplite_timeouts[UDPLITE_CT_MAX] = {
[UDPLITE_CT_UNREPLIED] = 30*HZ,
[UDPLITE_CT_REPLIED] = 180*HZ,
};
static bool udplite_pkt_to_tuple(const struct sk_buff *skb, static bool udplite_pkt_to_tuple(const struct sk_buff *skb,
unsigned int dataoff, unsigned int dataoff,
@@ -72,13 +80,14 @@ static int udplite_packet(struct nf_conn *ct,
stream. Extend timeout. */ stream. Extend timeout. */
if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) { if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_refresh_acct(ct, ctinfo, skb,
nf_ct_udplite_timeout_stream); udplite_timeouts[UDPLITE_CT_REPLIED]);
/* Also, more likely to be important, and not a probe */ /* Also, more likely to be important, and not a probe */
if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status)) if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
nf_conntrack_event_cache(IPCT_ASSURED, ct); nf_conntrack_event_cache(IPCT_ASSURED, ct);
} else } else {
nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udplite_timeout); nf_ct_refresh_acct(ct, ctinfo, skb,
udplite_timeouts[UDPLITE_CT_UNREPLIED]);
}
return NF_ACCEPT; return NF_ACCEPT;
} }
@@ -147,14 +156,14 @@ static struct ctl_table_header *udplite_sysctl_header;
static struct ctl_table udplite_sysctl_table[] = { static struct ctl_table udplite_sysctl_table[] = {
{ {
.procname = "nf_conntrack_udplite_timeout", .procname = "nf_conntrack_udplite_timeout",
.data = &nf_ct_udplite_timeout, .data = &udplite_timeouts[UDPLITE_CT_UNREPLIED],
.maxlen = sizeof(unsigned int), .maxlen = sizeof(unsigned int),
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec_jiffies, .proc_handler = proc_dointvec_jiffies,
}, },
{ {
.procname = "nf_conntrack_udplite_timeout_stream", .procname = "nf_conntrack_udplite_timeout_stream",
.data = &nf_ct_udplite_timeout_stream, .data = &udplite_timeouts[UDPLITE_CT_REPLIED],
.maxlen = sizeof(unsigned int), .maxlen = sizeof(unsigned int),
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec_jiffies, .proc_handler = proc_dointvec_jiffies,