git.openwrt.org Git - openwrt/openwrt.git/blob

   1 From: Oz Shlomo <ozsh@nvidia.com>
   2 Date: Thu, 3 Jun 2021 15:12:34 +0300
   3 Subject: [PATCH] netfilter: conntrack: Introduce udp offload timeout
   4  configuration
   5
   6 UDP connections may be offloaded from nf conntrack to nf flow table.
   7 Offloaded connections are aged after 30 seconds of inactivity.
   8 Once aged, ownership is returned to conntrack with a hard coded pickup
   9 time of 30 seconds, after which the connection may be deleted.
  10 eted. The current aging intervals may be too aggressive for some users.
  11
  12 Provide users with the ability to control the nf flow table offload
  13 aging and pickup time intervals via sysctl parameter as a pre-step for
  14 configuring the nf flow table GC timeout intervals.
  15
  16 Signed-off-by: Oz Shlomo <ozsh@nvidia.com>
  17 Reviewed-by: Paul Blakey <paulb@nvidia.com>
  18 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  19 ---
  20
  21 --- a/include/net/netns/conntrack.h
  22 +++ b/include/net/netns/conntrack.h
  23 @@ -41,6 +41,10 @@ enum udp_conntrack {
  24
  25  struct nf_udp_net {
  26         unsigned int timeouts[UDP_CT_MAX];
  27 +#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
  28 +       unsigned int offload_timeout;
  29 +       unsigned int offload_pickup;
  30 +#endif
  31  };
  32
  33  struct nf_icmp_net {
  34 --- a/net/netfilter/nf_conntrack_proto_udp.c
  35 +++ b/net/netfilter/nf_conntrack_proto_udp.c
  36 @@ -273,6 +273,11 @@ void nf_conntrack_udp_init_net(struct ne
  37
  38         for (i = 0; i < UDP_CT_MAX; i++)
  39                 un->timeouts[i] = udp_timeouts[i];
  40 +
  41 +#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
  42 +       un->offload_timeout = 30 * HZ;
  43 +       un->offload_pickup = 30 * HZ;
  44 +#endif
  45  }
  46
  47  const struct nf_conntrack_l4proto nf_conntrack_l4proto_udp =
  48 --- a/net/netfilter/nf_conntrack_standalone.c
  49 +++ b/net/netfilter/nf_conntrack_standalone.c
  50 @@ -576,6 +576,10 @@ enum nf_ct_sysctl_index {
  51         NF_SYSCTL_CT_PROTO_TCP_MAX_RETRANS,
  52         NF_SYSCTL_CT_PROTO_TIMEOUT_UDP,
  53         NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM,
  54 +#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
  55 +       NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD,
  56 +       NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD_PICKUP,
  57 +#endif
  58         NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP,
  59         NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6,
  60  #ifdef CONFIG_NF_CT_PROTO_SCTP
  61 @@ -809,6 +813,20 @@ static struct ctl_table nf_ct_sysctl_tab
  62                 .mode           = 0644,
  63                 .proc_handler   = proc_dointvec_jiffies,
  64         },
  65 +#if IS_ENABLED(CONFIG_NFT_FLOW_OFFLOAD)
  66 +       [NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD] = {
  67 +               .procname       = "nf_flowtable_udp_timeout",
  68 +               .maxlen         = sizeof(unsigned int),
  69 +               .mode           = 0644,
  70 +               .proc_handler   = proc_dointvec_jiffies,
  71 +       },
  72 +       [NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD_PICKUP] = {
  73 +               .procname       = "nf_flowtable_udp_pickup",
  74 +               .maxlen         = sizeof(unsigned int),
  75 +               .mode           = 0644,
  76 +               .proc_handler   = proc_dointvec_jiffies,
  77 +       },
  78 +#endif
  79         [NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP] = {
  80                 .procname       = "nf_conntrack_icmp_timeout",
  81                 .maxlen         = sizeof(unsigned int),
  82 @@ -1070,6 +1088,10 @@ static int nf_conntrack_standalone_init_
  83         table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6].data = &nf_icmpv6_pernet(net)->timeout;
  84         table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP].data = &un->timeouts[UDP_CT_UNREPLIED];
  85         table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_STREAM].data = &un->timeouts[UDP_CT_REPLIED];
  86 +#if IS_ENABLED(CONFIG_NF_FLOW_TABLE)
  87 +       table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD].data = &un->offload_timeout;
  88 +       table[NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD_PICKUP].data = &un->offload_pickup;
  89 +#endif
  90
  91         nf_conntrack_standalone_init_tcp_sysctl(net, table);
  92         nf_conntrack_standalone_init_sctp_sysctl(net, table);