mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-30 22:44:50 +08:00
4592ee7f52
These two sysctls were added because the hardcoded defaults (2 minutes, tcp, 30 seconds, udp) turned out to be too low for some setups. They appeared in 5.14-rc1 so it should be fine to remove it again. Marcelo convinced me that there should be no difference between a flow that was offloaded vs. a flow that was not wrt. timeout handling. Thus the default is changed to those for TCP established and UDP stream, 5 days and 120 seconds, respectively. Marcelo also suggested to account for the timeout value used for the offloading, this avoids increase beyond the value in the conntrack-sysctl and will also instantly expire the conntrack entry with altered sysctls. Example: nf_conntrack_udp_timeout_stream=60 nf_flowtable_udp_timeout=60 This will remove offloaded udp flows after one minute, rather than two. An earlier version of this patch also cleared the ASSURED bit to allow nf_conntrack to evict the entry via early_drop (i.e., table full). However, it looks like we can safely assume that connection timed out via HW is still in established state, so this isn't needed. Quoting Oz: [..] the hardware sends all packets with a set FIN flags to sw. [..] Connections that are aged in hardware are expected to be in the established state. In case it turns out that back-to-sw-path transition can occur for 'dodgy' connections too (e.g., one side disappeared while software-path would have been in RETRANS timeout), we can adjust this later. Cc: Oz Shlomo <ozsh@nvidia.com> Cc: Paul Blakey <paulb@nvidia.com> Suggested-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Reviewed-by: Oz Shlomo <ozsh@nvidia.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
123 lines
2.4 KiB
C
123 lines
2.4 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __NETNS_CONNTRACK_H
|
|
#define __NETNS_CONNTRACK_H
|
|
|
|
#include <linux/list.h>
|
|
#include <linux/list_nulls.h>
|
|
#include <linux/atomic.h>
|
|
#include <linux/workqueue.h>
|
|
#include <linux/netfilter/nf_conntrack_tcp.h>
|
|
#ifdef CONFIG_NF_CT_PROTO_DCCP
|
|
#include <linux/netfilter/nf_conntrack_dccp.h>
|
|
#endif
|
|
#ifdef CONFIG_NF_CT_PROTO_SCTP
|
|
#include <linux/netfilter/nf_conntrack_sctp.h>
|
|
#endif
|
|
#include <linux/seqlock.h>
|
|
|
|
struct ctl_table_header;
|
|
struct nf_conntrack_ecache;
|
|
|
|
struct nf_generic_net {
|
|
unsigned int timeout;
|
|
};
|
|
|
|
struct nf_tcp_net {
|
|
unsigned int timeouts[TCP_CONNTRACK_TIMEOUT_MAX];
|
|
u8 tcp_loose;
|
|
u8 tcp_be_liberal;
|
|
u8 tcp_max_retrans;
|
|
u8 tcp_ignore_invalid_rst;
|
|
#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
|
|
unsigned int offload_timeout;
|
|
#endif
|
|
};
|
|
|
|
enum udp_conntrack {
|
|
UDP_CT_UNREPLIED,
|
|
UDP_CT_REPLIED,
|
|
UDP_CT_MAX
|
|
};
|
|
|
|
struct nf_udp_net {
|
|
unsigned int timeouts[UDP_CT_MAX];
|
|
#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
|
|
unsigned int offload_timeout;
|
|
#endif
|
|
};
|
|
|
|
struct nf_icmp_net {
|
|
unsigned int timeout;
|
|
};
|
|
|
|
#ifdef CONFIG_NF_CT_PROTO_DCCP
|
|
struct nf_dccp_net {
|
|
u8 dccp_loose;
|
|
unsigned int dccp_timeout[CT_DCCP_MAX + 1];
|
|
};
|
|
#endif
|
|
|
|
#ifdef CONFIG_NF_CT_PROTO_SCTP
|
|
struct nf_sctp_net {
|
|
unsigned int timeouts[SCTP_CONNTRACK_MAX];
|
|
};
|
|
#endif
|
|
|
|
#ifdef CONFIG_NF_CT_PROTO_GRE
|
|
enum gre_conntrack {
|
|
GRE_CT_UNREPLIED,
|
|
GRE_CT_REPLIED,
|
|
GRE_CT_MAX
|
|
};
|
|
|
|
struct nf_gre_net {
|
|
struct list_head keymap_list;
|
|
unsigned int timeouts[GRE_CT_MAX];
|
|
};
|
|
#endif
|
|
|
|
struct nf_ip_net {
|
|
struct nf_generic_net generic;
|
|
struct nf_tcp_net tcp;
|
|
struct nf_udp_net udp;
|
|
struct nf_icmp_net icmp;
|
|
struct nf_icmp_net icmpv6;
|
|
#ifdef CONFIG_NF_CT_PROTO_DCCP
|
|
struct nf_dccp_net dccp;
|
|
#endif
|
|
#ifdef CONFIG_NF_CT_PROTO_SCTP
|
|
struct nf_sctp_net sctp;
|
|
#endif
|
|
#ifdef CONFIG_NF_CT_PROTO_GRE
|
|
struct nf_gre_net gre;
|
|
#endif
|
|
};
|
|
|
|
struct ct_pcpu {
|
|
spinlock_t lock;
|
|
struct hlist_nulls_head unconfirmed;
|
|
struct hlist_nulls_head dying;
|
|
};
|
|
|
|
struct netns_ct {
|
|
#ifdef CONFIG_NF_CONNTRACK_EVENTS
|
|
bool ecache_dwork_pending;
|
|
#endif
|
|
u8 sysctl_log_invalid; /* Log invalid packets */
|
|
u8 sysctl_events;
|
|
u8 sysctl_acct;
|
|
u8 sysctl_auto_assign_helper;
|
|
u8 sysctl_tstamp;
|
|
u8 sysctl_checksum;
|
|
|
|
struct ct_pcpu __percpu *pcpu_lists;
|
|
struct ip_conntrack_stat __percpu *stat;
|
|
struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb;
|
|
struct nf_exp_event_notifier __rcu *nf_expect_event_cb;
|
|
struct nf_ip_net nf_ct_proto;
|
|
#if defined(CONFIG_NF_CONNTRACK_LABELS)
|
|
unsigned int labels_used;
|
|
#endif
|
|
};
|
|
#endif
|