OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/net/netfilter
History
Pablo Neira Ayuso 60b5f8f745 netfilter: nf_conntrack: permanently attach timeout policy to conntrack 
We need to permanently attach the timeout policy to the conntrack,
otherwise we may apply the custom timeout policy inconsistently.

Without this patch, the following example:

 nfct timeout add test inet icmp timeout 100
 iptables -I PREROUTING -t raw -p icmp -s 1.1.1.1 -j CT --timeout test

Will only apply the custom timeout policy to outgoing packets from
1.1.1.1, but not to reply packets from 2.2.2.2 going to 1.1.1.1.

To fix this issue, this patch modifies the current logic to attach the
timeout policy when the first packet is seen (which is when the
conntrack entry is created). Then, we keep using the attached timeout
policy until the conntrack entry is destroyed.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
 		2012-03-23 00:52:08 +01:00
..
ipset netfilter: ipset: Exceptions support added to hash:*net* types 2012-03-07 17:40:35 +01:00
ipvs ipvs: fix matching of fwmark templates during scheduling 2012-02-04 20:27:58 +01:00
Kconfig netfilter: nf_ct_ext: add timeout extension 2012-03-07 17:41:25 +01:00
Makefile netfilter: nf_ct_ext: add timeout extension 2012-03-07 17:41:25 +01:00
core.c static keys: Introduce 'struct static_key', static_key_true()/false() and static_key_slow_[inc|dec]() 2012-02-24 10:05:59 +01:00
nf_conntrack_acct.c Merge branch 'nf-next' of git://1984.lsi.us.es/net-next 2011-12-25 02:21:45 -05:00
nf_conntrack_amanda.c
…
nf_conntrack_broadcast.c
…
nf_conntrack_core.c netfilter: nf_conntrack: permanently attach timeout policy to conntrack 2012-03-23 00:52:08 +01:00
nf_conntrack_ecache.c netfilter: nf_ct_ecache: refactor nf_ct_deliver_cached_events 2012-03-07 17:40:53 +01:00
nf_conntrack_expect.c netfilter: provide config option to disable ancient procfs parts 2011-12-27 20:45:28 +01:00
nf_conntrack_extend.c net: reintroduce missing rcu_assign_pointer() calls 2012-01-12 12:26:56 -08:00
nf_conntrack_ftp.c module_param: make bool parameters really bool (net & drivers/net) 2011-12-19 22:27:29 -05:00
nf_conntrack_h323_asn1.c
…
nf_conntrack_h323_main.c module_param: make bool parameters really bool (net & drivers/net) 2011-12-19 22:27:29 -05:00
nf_conntrack_h323_types.c
…
nf_conntrack_helper.c netfilter: ctnetlink: allow to set expectfn for expectations 2012-03-07 17:40:46 +01:00
nf_conntrack_irc.c netfilter: add more values to enum ip_conntrack_info 2011-06-06 01:35:10 +02:00
nf_conntrack_l3proto_generic.c
…
nf_conntrack_netbios_ns.c
…
nf_conntrack_netlink.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2012-03-18 23:29:41 -04:00
nf_conntrack_pptp.c netfilter: nf_ct_pptp: fix DNATed PPTP connection address translation 2011-08-30 15:23:03 +02:00
nf_conntrack_proto.c netfilter: cttimeout: fix dependency with l4protocol conntrack module 2012-03-23 00:52:01 +01:00
nf_conntrack_proto_dccp.c netfilter: add cttimeout infrastructure for fine timeout tuning 2012-03-07 17:41:22 +01:00
nf_conntrack_proto_generic.c netfilter: add cttimeout infrastructure for fine timeout tuning 2012-03-07 17:41:22 +01:00
nf_conntrack_proto_gre.c netfilter: add cttimeout infrastructure for fine timeout tuning 2012-03-07 17:41:22 +01:00
nf_conntrack_proto_sctp.c netfilter: add cttimeout infrastructure for fine timeout tuning 2012-03-07 17:41:22 +01:00
nf_conntrack_proto_tcp.c netfilter: add cttimeout infrastructure for fine timeout tuning 2012-03-07 17:41:22 +01:00
nf_conntrack_proto_udp.c netfilter: add cttimeout infrastructure for fine timeout tuning 2012-03-07 17:41:22 +01:00
nf_conntrack_proto_udplite.c netfilter: add cttimeout infrastructure for fine timeout tuning 2012-03-07 17:41:22 +01:00
nf_conntrack_sane.c netfilter: add more values to enum ip_conntrack_info 2011-06-06 01:35:10 +02:00
nf_conntrack_sip.c netfilter: add more values to enum ip_conntrack_info 2011-06-06 01:35:10 +02:00
nf_conntrack_snmp.c
…
nf_conntrack_standalone.c netfilter: provide config option to disable ancient procfs parts 2011-12-27 20:45:28 +01:00
nf_conntrack_tftp.c
…
nf_conntrack_timeout.c netfilter: nf_ct_ext: add timeout extension 2012-03-07 17:41:25 +01:00
nf_conntrack_timestamp.c module_param: make bool parameters really bool (net & drivers/net) 2011-12-19 22:27:29 -05:00
nf_internals.h
…
nf_log.c net: reintroduce missing rcu_assign_pointer() calls 2012-01-12 12:26:56 -08:00
nf_queue.c netfilter: nf_queue: fix queueing of bridged gro skbs 2012-02-09 20:47:53 +01:00
nf_sockopt.c
…
nf_tproxy_core.c
…
nfnetlink.c Merge branch 'for-linus' of git://selinuxproject.org/~jmorris/linux-security 2012-01-14 18:36:33 -08:00
nfnetlink_acct.c netlink: add netlink_dump_control structure for netlink_dump_start() 2012-02-26 14:10:06 -05:00
nfnetlink_cttimeout.c netfilter: cttimeout: fix dependency with l4protocol conntrack module 2012-03-23 00:52:01 +01:00
nfnetlink_log.c netfilter: Remove unnecessary OOM logging messages 2011-11-01 09:19:49 +01:00
nfnetlink_queue.c netfilter: nf_queue: reject NF_STOLEN verdicts from userspace 2011-08-30 15:01:20 +02:00
x_tables.c net: Fix files explicitly needing to include module.h 2011-10-31 19:30:28 -04:00
xt_AUDIT.c ipv6: Add fragment reporting to ipv6_skip_exthdr(). 2011-12-03 09:35:10 -08:00
xt_CHECKSUM.c
…
xt_CLASSIFY.c
…
xt_CONNSECMARK.c
…
xt_CT.c netfilter: xt_CT: fix assignation of the generic protocol tracker 2012-03-23 00:52:08 +01:00
xt_DSCP.c
…
xt_HL.c netfilter: Reduce switch/case indent 2011-07-01 16:11:15 -07:00
xt_IDLETIMER.c netfilter: Remove unnecessary OOM logging messages 2011-11-01 09:19:49 +01:00
xt_LED.c
…
xt_LOG.c netfilter: xt_LOG: use CONFIG_IP6_NF_IPTABLES instead of CONFIG_IPV6 2012-03-22 11:50:56 +01:00
xt_NFLOG.c
…
xt_NFQUEUE.c net:netfilter: use IS_ENABLED 2011-12-16 15:49:52 -05:00
xt_NOTRACK.c
…
xt_RATEEST.c net,rcu: Convert call_rcu(xt_rateest_free_rcu) to kfree_rcu() 2011-07-20 14:10:19 -07:00
xt_SECMARK.c
…
xt_TCPMSS.c net:netfilter: use IS_ENABLED 2011-12-16 15:49:52 -05:00
xt_TCPOPTSTRIP.c net:netfilter: use IS_ENABLED 2011-12-16 15:49:52 -05:00
xt_TEE.c netfilter: ip6_route_output() never returns NULL. 2012-02-22 15:30:15 -05:00
xt_TPROXY.c net:netfilter: use IS_ENABLED 2011-12-16 15:49:52 -05:00
xt_TRACE.c
…
xt_addrtype.c net:netfilter: use IS_ENABLED 2011-12-16 15:49:52 -05:00
xt_cluster.c
…
xt_comment.c
…
xt_connbytes.c Merge branch 'nf-next' of git://1984.lsi.us.es/net-next 2011-12-25 02:21:45 -05:00
xt_connlimit.c
…
xt_connmark.c
…
xt_conntrack.c
…
xt_cpu.c
…
xt_dccp.c
…
xt_devgroup.c
…
xt_dscp.c
…
xt_ecn.c netfilter: xtables: collapse conditions in xt_ecn 2011-12-27 20:45:25 +01:00
xt_esp.c
…
xt_hashlimit.c netfilter: xt_hashlimit: fix unused variable warning if IPv6 disabled 2012-01-16 13:40:54 +01:00
xt_helper.c
…
xt_hl.c netfilter: Reduce switch/case indent 2011-07-01 16:11:15 -07:00
xt_iprange.c
…
xt_ipvs.c
…
xt_length.c
…
xt_limit.c
…
xt_mac.c
…
xt_mark.c
…
xt_multiport.c
…
xt_nfacct.c netfilter: xtables: add nfacct match to support extended accounting 2011-12-25 02:43:17 +01:00
xt_osf.c
…
xt_owner.c
…
xt_physdev.c
…
xt_pkttype.c
…
xt_policy.c
…
xt_quota.c net: Fix files explicitly needing to include module.h 2011-10-31 19:30:28 -04:00
xt_rateest.c netfilter: xt_rateest: fix xt_rateest_mt_checkentry() 2011-07-29 16:24:46 +02:00
xt_realm.c
…
xt_recent.c
…
xt_repldata.h
…
xt_sctp.c
…
xt_set.c Remove redundant linux/version.h includes from net/ 2011-06-21 16:03:17 -07:00
xt_socket.c net:netfilter: use IS_ENABLED 2011-12-16 15:49:52 -05:00
xt_state.c
…
xt_statistic.c net: Fix files explicitly needing to include module.h 2011-10-31 19:30:28 -04:00
xt_string.c
…
xt_tcpmss.c
…
xt_tcpudp.c
…
xt_time.c
…
xt_u32.c
…