netfilter: conntrack: udp: only extend timeout to stream mode after 2s

Currently DNS resolvers that send both A and AAAA queries from same source port can trigger stream mode prematurely, which results in non-early-evictable conntrack entry for three minutes, even though DNS requests are done in a few milliseconds. Add a two second grace period where we continue to use the ordinary 30-second default timeout. Its enough for DNS request/response traffic, even if two request/reply packets are involved. ASSURED is still set, else conntrack (and thus a possible NAT mapping ...) gets zapped too in case conntrack table runs full.

Florian Westphal committed 7 years ago

Commit d535c8a1 parent 06aa1512 files · +18 −3Browse files

Showing the changes to include/net (1 of 2 files). Show all

Unified · Split

include/net/netfilter/nf_conntrack.h+5−0

@@ -27,12 +27,17 @@ · 26 unmodified lines
27	27
28	28	#include <net/netfilter/nf_conntrack_tuple.h>
29	29
	30	+struct nf_ct_udp {
	31	+ unsigned long stream_ts;
	32	+};
	33	+
30	34	/* per conntrack: protocol private data */
31	35	union nf_conntrack_proto {
32	36	/* insert conntrack proto private data here */
33	37	struct nf_ct_dccp dccp;
34	38	struct ip_ct_sctp sctp;
35	39	struct ip_ct_tcp tcp;
	40	+ struct nf_ct_udp udp;
36	41	struct nf_ct_gre gre;
37	42	unsigned int tmpl_padto;
38	43	};