* [PATCH 2.6] netfilter: make conntrack timeouts become sysctls
@ 2003-10-02 16:09 Harald Welte
2003-10-03 6:20 ` David S. Miller
0 siblings, 1 reply; 2+ messages in thread
From: Harald Welte @ 2003-10-02 16:09 UTC (permalink / raw)
To: David Miller; +Cc: Netfilter Development Mailinglist
[-- Attachment #1.1: Type: text/plain, Size: 1098 bytes --]
Hi Davem!
Please apply the following patchto your 2.6 tree, thanks.
Author: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
This patch introduces the /proc/sys/net/ipv4/netfilter/ directory for
the tuneable parameters of the conntrack engine of netfilter.
The parameters which can currently be fine-tuned (if required at all)
are the ip_conntrack_max, and the conntrack timeout parameters in seconds.
The default timeout value for the TCP CLOSE_WAIT state is raised to 3
days, which should cause less problems with long-lived half-closed TCP
sessions.
For the sake of compatibility with 2.4,
/proc/sys/net/ipv4/netfilter/ip_conntrack_max is duplicated as
/proc/sys/net/ipv4/ip_conntrack_max as well.
--
- Harald Welte <laforge@netfilter.org> http://www.netfilter.org/
============================================================================
"Fragmentation is like classful addressing -- an interesting early
architectural error that shows how much experimentation was going
on while IP was being designed." -- Paul Vixie
[-- Attachment #1.2: 80_ip_conntrack-proc.patch --]
[-- Type: text/plain, Size: 14792 bytes --]
diff -Nru --exclude .depend --exclude '*.o' --exclude '*.ko' --exclude '*.ver' --exclude '.*.flags' --exclude '*.orig' --exclude '*.rej' --exclude '*.cmd' --exclude '*.mod.c' --exclude '*~' linux-2.6.0-test6-plain/net/ipv4/netfilter/ip_conntrack_core.c linux-2.6.0-test6-ctsysctl/net/ipv4/netfilter/ip_conntrack_core.c
--- linux-2.6.0-test6-plain/net/ipv4/netfilter/ip_conntrack_core.c 2003-09-28 02:50:05.000000000 +0200
+++ linux-2.6.0-test6-ctsysctl/net/ipv4/netfilter/ip_conntrack_core.c 2003-10-02 17:16:56.000000000 +0200
@@ -59,7 +59,7 @@
LIST_HEAD(protocol_list);
static LIST_HEAD(helpers);
unsigned int ip_conntrack_htable_size = 0;
-static int ip_conntrack_max;
+int ip_conntrack_max;
static atomic_t ip_conntrack_count = ATOMIC_INIT(0);
struct list_head *ip_conntrack_hash;
static kmem_cache_t *ip_conntrack_cachep;
@@ -1325,45 +1325,6 @@
.get = &getorigdst,
};
-#define NET_IP_CONNTRACK_MAX 2089
-#define NET_IP_CONNTRACK_MAX_NAME "ip_conntrack_max"
-
-#ifdef CONFIG_SYSCTL
-static struct ctl_table_header *ip_conntrack_sysctl_header;
-
-static ctl_table ip_conntrack_table[] = {
- {
- .ctl_name = NET_IP_CONNTRACK_MAX,
- .procname = NET_IP_CONNTRACK_MAX_NAME,
- .data = &ip_conntrack_max,
- .maxlen = sizeof(ip_conntrack_max),
- .mode = 0644,
- .proc_handler = proc_dointvec
- },
- { .ctl_name = 0 }
-};
-
-static ctl_table ip_conntrack_dir_table[] = {
- {
- .ctl_name = NET_IPV4,
- .procname = "ipv4",
- .mode = 0555,
- .child = ip_conntrack_table
- },
- { .ctl_name = 0 }
-};
-
-static ctl_table ip_conntrack_root_table[] = {
- {
- .ctl_name = CTL_NET,
- .procname = "net",
- .mode = 0555,
- .child = ip_conntrack_dir_table
- },
- { .ctl_name = 0 }
-};
-#endif /*CONFIG_SYSCTL*/
-
static int kill_all(const struct ip_conntrack *i, void *data)
{
return 1;
@@ -1373,9 +1334,6 @@
supposed to kill the mall. */
void ip_conntrack_cleanup(void)
{
-#ifdef CONFIG_SYSCTL
- unregister_sysctl_table(ip_conntrack_sysctl_header);
-#endif
ip_ct_attach = NULL;
/* This makes sure all current packets have passed through
netfilter framework. Roll on, two-stage module
@@ -1453,25 +1411,10 @@
for (i = 0; i < ip_conntrack_htable_size; i++)
INIT_LIST_HEAD(&ip_conntrack_hash[i]);
-/* This is fucking braindead. There is NO WAY of doing this without
- the CONFIG_SYSCTL unless you don't want to detect errors.
- Grrr... --RR */
-#ifdef CONFIG_SYSCTL
- ip_conntrack_sysctl_header
- = register_sysctl_table(ip_conntrack_root_table, 0);
- if (ip_conntrack_sysctl_header == NULL) {
- goto err_free_ct_cachep;
- }
-#endif /*CONFIG_SYSCTL*/
-
/* For use by ipt_REJECT */
ip_ct_attach = ip_conntrack_attach;
return ret;
-#ifdef CONFIG_SYSCTL
-err_free_ct_cachep:
- kmem_cache_destroy(ip_conntrack_cachep);
-#endif /*CONFIG_SYSCTL*/
err_free_hash:
vfree(ip_conntrack_hash);
err_unreg_sockopt:
diff -Nru --exclude .depend --exclude '*.o' --exclude '*.ko' --exclude '*.ver' --exclude '.*.flags' --exclude '*.orig' --exclude '*.rej' --exclude '*.cmd' --exclude '*.mod.c' --exclude '*~' linux-2.6.0-test6-plain/net/ipv4/netfilter/ip_conntrack_proto_generic.c linux-2.6.0-test6-ctsysctl/net/ipv4/netfilter/ip_conntrack_proto_generic.c
--- linux-2.6.0-test6-plain/net/ipv4/netfilter/ip_conntrack_proto_generic.c 2003-09-28 02:50:15.000000000 +0200
+++ linux-2.6.0-test6-ctsysctl/net/ipv4/netfilter/ip_conntrack_proto_generic.c 2003-10-02 17:15:26.000000000 +0200
@@ -4,7 +4,7 @@
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
-#define GENERIC_TIMEOUT (600*HZ)
+unsigned long ip_ct_generic_timeout = 600*HZ;
static int generic_pkt_to_tuple(const struct sk_buff *skb,
unsigned int dataoff,
@@ -44,7 +44,7 @@
const struct sk_buff *skb,
enum ip_conntrack_info conntrackinfo)
{
- ip_ct_refresh(conntrack, GENERIC_TIMEOUT);
+ ip_ct_refresh(conntrack, ip_ct_generic_timeout);
return NF_ACCEPT;
}
diff -Nru --exclude .depend --exclude '*.o' --exclude '*.ko' --exclude '*.ver' --exclude '.*.flags' --exclude '*.orig' --exclude '*.rej' --exclude '*.cmd' --exclude '*.mod.c' --exclude '*~' linux-2.6.0-test6-plain/net/ipv4/netfilter/ip_conntrack_proto_icmp.c linux-2.6.0-test6-ctsysctl/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
--- linux-2.6.0-test6-plain/net/ipv4/netfilter/ip_conntrack_proto_icmp.c 2003-09-28 02:50:06.000000000 +0200
+++ linux-2.6.0-test6-ctsysctl/net/ipv4/netfilter/ip_conntrack_proto_icmp.c 2003-10-02 17:15:26.000000000 +0200
@@ -6,7 +6,7 @@
#include <linux/icmp.h>
#include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
-#define ICMP_TIMEOUT (30*HZ)
+unsigned long ip_ct_icmp_timeout = 30*HZ;
#if 0
#define DEBUGP printk
@@ -86,7 +86,7 @@
ct->timeout.function((unsigned long)ct);
} else {
atomic_inc(&ct->proto.icmp.count);
- ip_ct_refresh(ct, ICMP_TIMEOUT);
+ ip_ct_refresh(ct, ip_ct_icmp_timeout);
}
return NF_ACCEPT;
diff -Nru --exclude .depend --exclude '*.o' --exclude '*.ko' --exclude '*.ver' --exclude '.*.flags' --exclude '*.orig' --exclude '*.rej' --exclude '*.cmd' --exclude '*.mod.c' --exclude '*~' linux-2.6.0-test6-plain/net/ipv4/netfilter/ip_conntrack_proto_tcp.c linux-2.6.0-test6-ctsysctl/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
--- linux-2.6.0-test6-plain/net/ipv4/netfilter/ip_conntrack_proto_tcp.c 2003-09-28 02:51:15.000000000 +0200
+++ linux-2.6.0-test6-ctsysctl/net/ipv4/netfilter/ip_conntrack_proto_tcp.c 2003-10-02 17:15:26.000000000 +0200
@@ -49,20 +49,28 @@
#define HOURS * 60 MINS
#define DAYS * 24 HOURS
-
-static unsigned long tcp_timeouts[]
-= { 30 MINS, /* TCP_CONNTRACK_NONE, */
- 5 DAYS, /* TCP_CONNTRACK_ESTABLISHED, */
- 2 MINS, /* TCP_CONNTRACK_SYN_SENT, */
- 60 SECS, /* TCP_CONNTRACK_SYN_RECV, */
- 2 MINS, /* TCP_CONNTRACK_FIN_WAIT, */
- 2 MINS, /* TCP_CONNTRACK_TIME_WAIT, */
- 10 SECS, /* TCP_CONNTRACK_CLOSE, */
- 60 SECS, /* TCP_CONNTRACK_CLOSE_WAIT, */
- 30 SECS, /* TCP_CONNTRACK_LAST_ACK, */
- 2 MINS, /* TCP_CONNTRACK_LISTEN, */
-};
-
+unsigned long ip_ct_tcp_timeout_syn_sent = 2 MINS;
+unsigned long ip_ct_tcp_timeout_syn_recv = 60 SECS;
+unsigned long ip_ct_tcp_timeout_established = 5 DAYS;
+unsigned long ip_ct_tcp_timeout_fin_wait = 2 MINS;
+unsigned long ip_ct_tcp_timeout_close_wait = 3 DAYS;
+unsigned long ip_ct_tcp_timeout_last_ack = 30 SECS;
+unsigned long ip_ct_tcp_timeout_time_wait = 2 MINS;
+unsigned long ip_ct_tcp_timeout_close = 10 SECS;
+
+static unsigned long * tcp_timeouts[]
+= { 0, /* TCP_CONNTRACK_NONE */
+ &ip_ct_tcp_timeout_established, /* TCP_CONNTRACK_ESTABLISHED, */
+ &ip_ct_tcp_timeout_syn_sent, /* TCP_CONNTRACK_SYN_SENT, */
+ &ip_ct_tcp_timeout_syn_recv, /* TCP_CONNTRACK_SYN_RECV, */
+ &ip_ct_tcp_timeout_fin_wait, /* TCP_CONNTRACK_FIN_WAIT, */
+ &ip_ct_tcp_timeout_time_wait, /* TCP_CONNTRACK_TIME_WAIT, */
+ &ip_ct_tcp_timeout_close, /* TCP_CONNTRACK_CLOSE, */
+ &ip_ct_tcp_timeout_close_wait, /* TCP_CONNTRACK_CLOSE_WAIT, */
+ &ip_ct_tcp_timeout_last_ack, /* TCP_CONNTRACK_LAST_ACK, */
+ 0, /* TCP_CONNTRACK_LISTEN */
+ };
+
#define sNO TCP_CONNTRACK_NONE
#define sES TCP_CONNTRACK_ESTABLISHED
#define sSS TCP_CONNTRACK_SYN_SENT
@@ -204,7 +212,7 @@
set_bit(IPS_ASSURED_BIT, &conntrack->status);
WRITE_UNLOCK(&tcp_lock);
- ip_ct_refresh(conntrack, tcp_timeouts[newconntrack]);
+ ip_ct_refresh(conntrack, *tcp_timeouts[newconntrack]);
}
return NF_ACCEPT;
diff -Nru --exclude .depend --exclude '*.o' --exclude '*.ko' --exclude '*.ver' --exclude '.*.flags' --exclude '*.orig' --exclude '*.rej' --exclude '*.cmd' --exclude '*.mod.c' --exclude '*~' linux-2.6.0-test6-plain/net/ipv4/netfilter/ip_conntrack_proto_udp.c linux-2.6.0-test6-ctsysctl/net/ipv4/netfilter/ip_conntrack_proto_udp.c
--- linux-2.6.0-test6-plain/net/ipv4/netfilter/ip_conntrack_proto_udp.c 2003-09-28 02:50:05.000000000 +0200
+++ linux-2.6.0-test6-ctsysctl/net/ipv4/netfilter/ip_conntrack_proto_udp.c 2003-10-02 17:15:26.000000000 +0200
@@ -6,8 +6,8 @@
#include <linux/udp.h>
#include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
-#define UDP_TIMEOUT (30*HZ)
-#define UDP_STREAM_TIMEOUT (180*HZ)
+unsigned long ip_ct_udp_timeout = 30*HZ;
+unsigned long ip_ct_udp_timeout_stream = 180*HZ;
static int udp_pkt_to_tuple(const struct sk_buff *skb,
unsigned int dataoff,
@@ -57,11 +57,11 @@
/* If we've seen traffic both ways, this is some kind of UDP
stream. Extend timeout. */
if (test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
- ip_ct_refresh(conntrack, UDP_STREAM_TIMEOUT);
+ ip_ct_refresh(conntrack, ip_ct_udp_timeout_stream);
/* Also, more likely to be important, and not a probe */
set_bit(IPS_ASSURED_BIT, &conntrack->status);
} else
- ip_ct_refresh(conntrack, UDP_TIMEOUT);
+ ip_ct_refresh(conntrack, ip_ct_udp_timeout);
return NF_ACCEPT;
}
diff -Nru --exclude .depend --exclude '*.o' --exclude '*.ko' --exclude '*.ver' --exclude '.*.flags' --exclude '*.orig' --exclude '*.rej' --exclude '*.cmd' --exclude '*.mod.c' --exclude '*~' linux-2.6.0-test6-plain/net/ipv4/netfilter/ip_conntrack_standalone.c linux-2.6.0-test6-ctsysctl/net/ipv4/netfilter/ip_conntrack_standalone.c
--- linux-2.6.0-test6-plain/net/ipv4/netfilter/ip_conntrack_standalone.c 2003-09-28 02:50:18.000000000 +0200
+++ linux-2.6.0-test6-ctsysctl/net/ipv4/netfilter/ip_conntrack_standalone.c 2003-10-02 17:17:46.000000000 +0200
@@ -7,6 +7,7 @@
/* (c) 1999 Paul `Rusty' Russell. Licenced under the GNU General
Public Licence. */
+#include <linux/config.h>
#include <linux/types.h>
#include <linux/ip.h>
#include <linux/netfilter.h>
@@ -14,6 +15,9 @@
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/proc_fs.h>
+#ifdef CONFIG_SYSCTL
+#include <linux/sysctl.h>
+#endif
#include <net/checksum.h>
#define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_conntrack_lock)
@@ -256,6 +260,98 @@
.priority = NF_IP_PRI_LAST-1,
};
+/* Sysctl support */
+
+#ifdef CONFIG_SYSCTL
+
+/* From ip_conntrack_core.c */
+extern int ip_conntrack_max;
+
+/* From ip_conntrack_proto_tcp.c */
+extern unsigned long ip_ct_tcp_timeout_syn_sent;
+extern unsigned long ip_ct_tcp_timeout_syn_recv;
+extern unsigned long ip_ct_tcp_timeout_established;
+extern unsigned long ip_ct_tcp_timeout_fin_wait;
+extern unsigned long ip_ct_tcp_timeout_close_wait;
+extern unsigned long ip_ct_tcp_timeout_last_ack;
+extern unsigned long ip_ct_tcp_timeout_time_wait;
+extern unsigned long ip_ct_tcp_timeout_close;
+
+/* From ip_conntrack_proto_udp.c */
+extern unsigned long ip_ct_udp_timeout;
+extern unsigned long ip_ct_udp_timeout_stream;
+
+/* From ip_conntrack_proto_icmp.c */
+extern unsigned long ip_ct_icmp_timeout;
+
+/* From ip_conntrack_proto_icmp.c */
+extern unsigned long ip_ct_generic_timeout;
+
+static struct ctl_table_header *ip_ct_sysctl_header;
+
+static ctl_table ip_ct_sysctl_table[] = {
+ {NET_IPV4_NF_CONNTRACK_MAX, "ip_conntrack_max",
+ &ip_conntrack_max, sizeof(int), 0644, NULL,
+ &proc_dointvec},
+ {NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_SENT, "ip_conntrack_tcp_timeout_syn_sent",
+ &ip_ct_tcp_timeout_syn_sent, sizeof(unsigned int), 0644, NULL,
+ &proc_dointvec_jiffies},
+ {NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_SYN_RECV, "ip_conntrack_tcp_timeout_syn_recv",
+ &ip_ct_tcp_timeout_syn_recv, sizeof(unsigned int), 0644, NULL,
+ &proc_dointvec_jiffies},
+ {NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_ESTABLISHED, "ip_conntrack_tcp_timeout_established",
+ &ip_ct_tcp_timeout_established, sizeof(unsigned int), 0644, NULL,
+ &proc_dointvec_jiffies},
+ {NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_FIN_WAIT, "ip_conntrack_tcp_timeout_fin_wait",
+ &ip_ct_tcp_timeout_fin_wait, sizeof(unsigned int), 0644, NULL,
+ &proc_dointvec_jiffies},
+ {NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE_WAIT, "ip_conntrack_tcp_timeout_close_wait",
+ &ip_ct_tcp_timeout_close_wait, sizeof(unsigned int), 0644, NULL,
+ &proc_dointvec_jiffies},
+ {NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_LAST_ACK, "ip_conntrack_tcp_timeout_last_ack",
+ &ip_ct_tcp_timeout_last_ack, sizeof(unsigned int), 0644, NULL,
+ &proc_dointvec_jiffies},
+ {NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_TIME_WAIT, "ip_conntrack_tcp_timeout_time_wait",
+ &ip_ct_tcp_timeout_time_wait, sizeof(unsigned int), 0644, NULL,
+ &proc_dointvec_jiffies},
+ {NET_IPV4_NF_CONNTRACK_TCP_TIMEOUT_CLOSE, "ip_conntrack_tcp_timeout_close",
+ &ip_ct_tcp_timeout_close, sizeof(unsigned int), 0644, NULL,
+ &proc_dointvec_jiffies},
+ {NET_IPV4_NF_CONNTRACK_UDP_TIMEOUT, "ip_conntrack_udp_timeout",
+ &ip_ct_udp_timeout, sizeof(unsigned int), 0644, NULL,
+ &proc_dointvec_jiffies},
+ {NET_IPV4_NF_CONNTRACK_UDP_TIMEOUT_STREAM, "ip_conntrack_udp_timeout_stream",
+ &ip_ct_udp_timeout_stream, sizeof(unsigned int), 0644, NULL,
+ &proc_dointvec_jiffies},
+ {NET_IPV4_NF_CONNTRACK_ICMP_TIMEOUT, "ip_conntrack_icmp_timeout",
+ &ip_ct_icmp_timeout, sizeof(unsigned int), 0644, NULL,
+ &proc_dointvec_jiffies},
+ {NET_IPV4_NF_CONNTRACK_GENERIC_TIMEOUT, "ip_conntrack_generic_timeout",
+ &ip_ct_generic_timeout, sizeof(unsigned int), 0644, NULL,
+ &proc_dointvec_jiffies},
+ {0}
+};
+
+#define NET_IP_CONNTRACK_MAX 2089
+
+static ctl_table ip_ct_netfilter_table[] = {
+ {NET_IPV4_NETFILTER, "netfilter", NULL, 0, 0555, ip_ct_sysctl_table, 0, 0, 0, 0, 0},
+ {NET_IP_CONNTRACK_MAX, "ip_conntrack_max",
+ &ip_conntrack_max, sizeof(int), 0644, NULL,
+ &proc_dointvec},
+ {0}
+};
+
+static ctl_table ip_ct_ipv4_table[] = {
+ {NET_IPV4, "ipv4", NULL, 0, 0555, ip_ct_netfilter_table, 0, 0, 0, 0, 0},
+ {0}
+};
+
+static ctl_table ip_ct_net_table[] = {
+ {CTL_NET, "net", NULL, 0, 0555, ip_ct_ipv4_table, 0, 0, 0, 0, 0},
+ {0}
+};
+#endif
static int init_or_cleanup(int init)
{
struct proc_dir_entry *proc;
@@ -291,10 +387,20 @@
printk("ip_conntrack: can't register local in hook.\n");
goto cleanup_inoutandlocalops;
}
+#ifdef CONFIG_SYSCTL
+ ip_ct_sysctl_header = register_sysctl_table(ip_ct_net_table, 0);
+ if (ip_ct_sysctl_header == NULL) {
+ printk("ip_conntrack: can't register to sysctl.\n");
+ goto cleanup;
+ }
+#endif
return ret;
cleanup:
+#ifdef CONFIG_SYSCTL
+ unregister_sysctl_table(ip_ct_sysctl_header);
+#endif
nf_unregister_hook(&ip_conntrack_local_in_ops);
cleanup_inoutandlocalops:
nf_unregister_hook(&ip_conntrack_out_ops);
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2003-10-03 6:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-10-02 16:09 [PATCH 2.6] netfilter: make conntrack timeouts become sysctls Harald Welte
2003-10-03 6:20 ` David S. Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.