From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 31/37] netfilter: conntrack: register sysctl table for gre
Date: Fri, 21 Dec 2018 01:28:35 +0100 [thread overview]
Message-ID: <20181221002841.28587-32-pablo@netfilter.org> (raw)
In-Reply-To: <20181221002841.28587-1-pablo@netfilter.org>
From: Yafang Shao <laoar.shao@gmail.com>
This patch adds two sysctl knobs for GRE:
net.netfilter.nf_conntrack_gre_timeout = 30
net.netfilter.nf_conntrack_gre_timeout_stream = 180
Update the Documentation as well.
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
Documentation/networking/nf_conntrack-sysctl.txt | 9 +++++
net/netfilter/nf_conntrack_proto_gre.c | 42 +++++++++++++++++++++++-
2 files changed, 50 insertions(+), 1 deletion(-)
diff --git a/Documentation/networking/nf_conntrack-sysctl.txt b/Documentation/networking/nf_conntrack-sysctl.txt
index e69b2e6a4a29..f75c2ce6e136 100644
--- a/Documentation/networking/nf_conntrack-sysctl.txt
+++ b/Documentation/networking/nf_conntrack-sysctl.txt
@@ -161,3 +161,12 @@ nf_conntrack_udp_timeout_stream - INTEGER (seconds)
This extended timeout will be used in case there is an UDP stream
detected.
+
+nf_conntrack_gre_timeout - INTEGER (seconds)
+ default 30
+
+nf_conntrack_gre_timeout_stream - INTEGER (seconds)
+ default 180
+
+ This extended timeout will be used in case there is an GRE stream
+ detected.
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index 9b48dc8b4b88..d5e76bc37b89 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -332,9 +332,49 @@ gre_timeout_nla_policy[CTA_TIMEOUT_GRE_MAX+1] = {
};
#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
+#ifdef CONFIG_SYSCTL
+static struct ctl_table gre_sysctl_table[] = {
+ {
+ .procname = "nf_conntrack_gre_timeout",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ {
+ .procname = "nf_conntrack_gre_timeout_stream",
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_jiffies,
+ },
+ {}
+};
+#endif
+
+static int gre_kmemdup_sysctl_table(struct net *net, struct nf_proto_net *nf,
+ struct netns_proto_gre *net_gre)
+{
+#ifdef CONFIG_SYSCTL
+ int i;
+
+ if (nf->ctl_table)
+ return 0;
+
+ nf->ctl_table = kmemdup(gre_sysctl_table,
+ sizeof(gre_sysctl_table),
+ GFP_KERNEL);
+ if (!nf->ctl_table)
+ return -ENOMEM;
+
+ for (i = 0; i < GRE_CT_MAX; i++)
+ nf->ctl_table[i].data = &net_gre->gre_timeouts[i];
+#endif
+ return 0;
+}
+
static int gre_init_net(struct net *net)
{
struct netns_proto_gre *net_gre = gre_pernet(net);
+ struct nf_proto_net *nf = &net_gre->nf;
int i;
rwlock_init(&net_gre->keymap_lock);
@@ -342,7 +382,7 @@ static int gre_init_net(struct net *net)
for (i = 0; i < GRE_CT_MAX; i++)
net_gre->gre_timeouts[i] = gre_timeouts[i];
- return 0;
+ return gre_kmemdup_sysctl_table(net, nf, net_gre);
}
/* protocol helper struct */
--
2.11.0
next prev parent reply other threads:[~2018-12-21 0:29 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-21 0:28 [PATCH 00/37] Netfilter updates for net-next Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 01/37] netfilter: ipset: Allow matching on destination MAC address for mac and ipmac sets Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 02/37] netfilter: ipset: Make invalid MAC address checks consistent Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 03/37] netfilter: ipset: Introduction of new commands and protocol version 7 Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 04/37] netfilter: ctnetlink: always honor CTA_MARK_MASK Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 05/37] netfilter: nf_flow_table: make nf_flow_table_iterate() static Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 06/37] netfilter: nf_flow_table: simplify nf_flow_offload_gc_step() Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 07/37] netfilter: Replace call_rcu_bh(), rcu_barrier_bh(), and synchronize_rcu_bh() Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 08/37] netfilter: remove NFC_* cache bits Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 09/37] netfilter: nat: remove l4 protocol port rovers Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 10/37] netfilter: ipset: fix ip_set_byindex function Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 11/37] netfilter: ipset: replace a strncpy() with strscpy() Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 12/37] netfilter: nat: remove unnecessary 'else if' branch Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 13/37] netfilter: nat: limit port clash resolution attempts Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 14/37] netfilter: remove unused parameters in nf_ct_l4proto_[un]register_sysctl() Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 15/37] netfilter: remove NF_NAT_RANGE_PROTO_RANDOM support Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 16/37] netfilter: nat: un-export nf_nat_l4proto_unique_tuple Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 17/37] netfilter: nat: remove l4proto->unique_tuple Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 18/37] netfilter: nat: fold in_range indirection into caller Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 19/37] netfilter: nat: remove l4proto->in_range Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 20/37] netfilter: nat: remove l4proto->nlattr_to_range Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 21/37] netfilter: nat: remove l4proto->manip_pkt Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 22/37] netfilter: nat: remove nf_nat_l4proto struct Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 23/37] netfilter: nf_nat_sip: fix RTP/RTCP source port translations Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 24/37] netfilter: nf_tables: Speed up selective rule dumps Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 25/37] netfilter: ipt_CLUSTERIP: fix deadlock in netns exit routine Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 26/37] netfilter: ipt_CLUSTERIP: remove wrong WARN_ON_ONCE " Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 27/37] netfilter: ipt_CLUSTERIP: fix sleep-in-atomic bug in clusterip_config_entry_put() Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 28/37] netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 29/37] netfilter: conntrack: udp: only extend timeout to stream mode after 2s Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 30/37] netfilter: conntrack: udp: set stream timeout to 2 minutes Pablo Neira Ayuso
2018-12-21 0:28 ` Pablo Neira Ayuso [this message]
2018-12-21 0:28 ` [PATCH 32/37] netfilter: conntrack: un-export seq_print_acct Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 33/37] netfilter: conntrack: add mnemonics for sysctl table Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 34/37] netfilter: conntrack: merge acct and helper sysctl table with main one Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 35/37] netfilter: conntrack: merge ecache and timestamp sysctl tables " Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 36/37] netfilter: conntrack: remove empty pernet fini stubs Pablo Neira Ayuso
2018-12-21 0:28 ` [PATCH 37/37] netfilter: netns: shrink netns_ct struct Pablo Neira Ayuso
2018-12-21 2:48 ` [PATCH 00/37] Netfilter updates for net-next David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181221002841.28587-32-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).