[NETFILTER]: H.323 helper: avoid long expectation chains

[NETFILTER]: H.323 helper: avoid long expectation chains

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 71 bytes --]

This is the last patch for now, the others still need a bit more work.

[-- Attachment #2: 06.diff --]
[-- Type: text/x-patch, Size: 1522 bytes --]

[NETFILTER]: H.323 helper: avoid long expectation chains

The RAS helper can exect new RAS connections when Gatekeeper discovery
is performed. This could lead to a situation where there is a long
chain of master conntracks which is recursively freed by destroy_conntrack
or which consumes lots of memory with only a single hashed conntrack,
decreasing chances of beeing evicted under memory pressure.

Avoid creating RAS expectations for already expected connections.

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit 74dc9a728dc33fab70b73ee30aca44bd2a0259ec
tree 6d3d7b250377b8587c9e32236ac22d91f4fb3300
parent 134aa8950c66de37bd644e7826c4d5cb1f1535ab
author Patrick McHardy <kaber@trash.net> Thu, 23 Feb 2006 20:22:10 +0100
committer Patrick McHardy <kaber@trash.net> Thu, 23 Feb 2006 20:22:10 +0100

 net/ipv4/netfilter/ip_conntrack_helper_h323.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323.c b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
index 5692b2f..fa6e73f 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
@@ -1091,6 +1091,10 @@ static int process_gcf(struct sk_buff **
 	    port == ntohs(ct->tuplehash[dir].tuple.src.u.udp.port))
 		return 0;
 
+	/* Avoid RAS expectation loops. A GCF is never expected. */
+	if (test_bit(IPS_EXPECTED_BIT, &ct->status))
+		return 0;
+
 	/* Need new expect */
 	if ((exp = ip_conntrack_expect_alloc(ct)) == NULL)
 		return -1;