2008-10-08 17:35:02 +08:00
|
|
|
#ifndef __NETNS_CONNTRACK_H
|
|
|
|
|
#define __NETNS_CONNTRACK_H
|
|
|
|
|
|
2008-10-08 17:35:04 +08:00
|
|
|
#include <linux/list.h>
|
2009-03-26 04:05:46 +08:00
|
|
|
#include <linux/list_nulls.h>
|
2011-07-27 07:09:06 +08:00
|
|
|
#include <linux/atomic.h>
|
2012-05-29 05:04:12 +08:00
|
|
|
#include <linux/netfilter/nf_conntrack_tcp.h>
|
2008-10-08 17:35:03 +08:00
|
|
|
|
2008-10-08 17:35:08 +08:00
|
|
|
struct ctl_table_header;
|
2008-10-08 17:35:07 +08:00
|
|
|
struct nf_conntrack_ecache;
|
|
|
|
|
|
2012-05-29 05:04:09 +08:00
|
|
|
struct nf_proto_net {
|
|
|
|
|
#ifdef CONFIG_SYSCTL
|
|
|
|
|
struct ctl_table_header *ctl_table_header;
|
|
|
|
|
struct ctl_table *ctl_table;
|
|
|
|
|
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
|
|
|
|
|
struct ctl_table_header *ctl_compat_header;
|
|
|
|
|
struct ctl_table *ctl_compat_table;
|
|
|
|
|
#endif
|
|
|
|
|
#endif
|
|
|
|
|
unsigned int users;
|
|
|
|
|
};
|
|
|
|
|
|
2012-05-29 05:04:11 +08:00
|
|
|
struct nf_generic_net {
|
|
|
|
|
struct nf_proto_net pn;
|
|
|
|
|
unsigned int timeout;
|
|
|
|
|
};
|
|
|
|
|
|
2012-05-29 05:04:12 +08:00
|
|
|
struct nf_tcp_net {
|
|
|
|
|
struct nf_proto_net pn;
|
|
|
|
|
unsigned int timeouts[TCP_CONNTRACK_TIMEOUT_MAX];
|
|
|
|
|
unsigned int tcp_loose;
|
|
|
|
|
unsigned int tcp_be_liberal;
|
|
|
|
|
unsigned int tcp_max_retrans;
|
|
|
|
|
};
|
|
|
|
|
|
2012-05-29 05:04:13 +08:00
|
|
|
enum udp_conntrack {
|
|
|
|
|
UDP_CT_UNREPLIED,
|
|
|
|
|
UDP_CT_REPLIED,
|
|
|
|
|
UDP_CT_MAX
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct nf_udp_net {
|
|
|
|
|
struct nf_proto_net pn;
|
|
|
|
|
unsigned int timeouts[UDP_CT_MAX];
|
|
|
|
|
};
|
|
|
|
|
|
2012-05-29 05:04:14 +08:00
|
|
|
struct nf_icmp_net {
|
|
|
|
|
struct nf_proto_net pn;
|
|
|
|
|
unsigned int timeout;
|
|
|
|
|
};
|
|
|
|
|
|
2012-05-29 05:04:10 +08:00
|
|
|
struct nf_ip_net {
|
2012-05-29 05:04:11 +08:00
|
|
|
struct nf_generic_net generic;
|
2012-05-29 05:04:12 +08:00
|
|
|
struct nf_tcp_net tcp;
|
2012-05-29 05:04:13 +08:00
|
|
|
struct nf_udp_net udp;
|
2012-05-29 05:04:14 +08:00
|
|
|
struct nf_icmp_net icmp;
|
2012-05-29 05:04:15 +08:00
|
|
|
struct nf_icmp_net icmpv6;
|
2012-05-29 05:04:10 +08:00
|
|
|
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
|
|
|
|
|
struct ctl_table_header *ctl_table_header;
|
|
|
|
|
struct ctl_table *ctl_table;
|
|
|
|
|
#endif
|
|
|
|
|
};
|
|
|
|
|
|
2008-10-08 17:35:02 +08:00
|
|
|
struct netns_ct {
|
2008-10-08 17:35:03 +08:00
|
|
|
atomic_t count;
|
2008-10-08 17:35:03 +08:00
|
|
|
unsigned int expect_count;
|
2010-02-09 03:18:07 +08:00
|
|
|
unsigned int htable_size;
|
2010-02-09 03:16:56 +08:00
|
|
|
struct kmem_cache *nf_conntrack_cachep;
|
2009-03-26 04:05:46 +08:00
|
|
|
struct hlist_nulls_head *hash;
|
2008-10-08 17:35:03 +08:00
|
|
|
struct hlist_head *expect_hash;
|
2009-03-26 04:05:46 +08:00
|
|
|
struct hlist_nulls_head unconfirmed;
|
netfilter: conntrack: optional reliable conntrack event delivery
This patch improves ctnetlink event reliability if one broadcast
listener has set the NETLINK_BROADCAST_ERROR socket option.
The logic is the following: if an event delivery fails, we keep
the undelivered events in the missed event cache. Once the next
packet arrives, we add the new events (if any) to the missed
events in the cache and we try a new delivery, and so on. Thus,
if ctnetlink fails to deliver an event, we try to deliver them
once we see a new packet. Therefore, we may lose state
transitions but the userspace process gets in sync at some point.
At worst case, if no events were delivered to userspace, we make
sure that destroy events are successfully delivered. Basically,
if ctnetlink fails to deliver the destroy event, we remove the
conntrack entry from the hashes and we insert them in the dying
list, which contains inactive entries. Then, the conntrack timer
is added with an extra grace timeout of random32() % 15 seconds
to trigger the event again (this grace timeout is tunable via
/proc). The use of a limited random timeout value allows
distributing the "destroy" resends, thus, avoiding accumulating
lots "destroy" events at the same time. Event delivery may
re-order but we can identify them by means of the tuple plus
the conntrack ID.
The maximum number of conntrack entries (active or inactive) is
still handled by nf_conntrack_max. Thus, we may start dropping
packets at some point if we accumulate a lot of inactive conntrack
entries that did not successfully report the destroy event to
userspace.
During my stress tests consisting of setting a very small buffer
of 2048 bytes for conntrackd and the NETLINK_BROADCAST_ERROR socket
flag, and generating lots of very small connections, I noticed
very few destroy entries on the fly waiting to be resend.
A simple way to test this patch consist of creating a lot of
entries, set a very small Netlink buffer in conntrackd (+ a patch
which is not in the git tree to set the BROADCAST_ERROR flag)
and invoke `conntrack -F'.
For expectations, no changes are introduced in this patch.
Currently, event delivery is only done for new expectations (no
events from expectation expiration, removal and confirmation).
In that case, they need a per-expectation event cache to implement
the same idea that is exposed in this patch.
This patch can be useful to provide reliable flow-accouting. We
still have to add a new conntrack extension to store the creation
and destroy time.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2009-06-13 18:30:52 +08:00
|
|
|
struct hlist_nulls_head dying;
|
2012-12-11 12:07:42 +08:00
|
|
|
struct hlist_nulls_head tmpl;
|
2010-02-16 23:20:26 +08:00
|
|
|
struct ip_conntrack_stat __percpu *stat;
|
2011-11-22 07:16:51 +08:00
|
|
|
struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb;
|
|
|
|
|
struct nf_exp_event_notifier __rcu *nf_expect_event_cb;
|
2009-06-13 18:26:29 +08:00
|
|
|
int sysctl_events;
|
netfilter: conntrack: optional reliable conntrack event delivery
This patch improves ctnetlink event reliability if one broadcast
listener has set the NETLINK_BROADCAST_ERROR socket option.
The logic is the following: if an event delivery fails, we keep
the undelivered events in the missed event cache. Once the next
packet arrives, we add the new events (if any) to the missed
events in the cache and we try a new delivery, and so on. Thus,
if ctnetlink fails to deliver an event, we try to deliver them
once we see a new packet. Therefore, we may lose state
transitions but the userspace process gets in sync at some point.
At worst case, if no events were delivered to userspace, we make
sure that destroy events are successfully delivered. Basically,
if ctnetlink fails to deliver the destroy event, we remove the
conntrack entry from the hashes and we insert them in the dying
list, which contains inactive entries. Then, the conntrack timer
is added with an extra grace timeout of random32() % 15 seconds
to trigger the event again (this grace timeout is tunable via
/proc). The use of a limited random timeout value allows
distributing the "destroy" resends, thus, avoiding accumulating
lots "destroy" events at the same time. Event delivery may
re-order but we can identify them by means of the tuple plus
the conntrack ID.
The maximum number of conntrack entries (active or inactive) is
still handled by nf_conntrack_max. Thus, we may start dropping
packets at some point if we accumulate a lot of inactive conntrack
entries that did not successfully report the destroy event to
userspace.
During my stress tests consisting of setting a very small buffer
of 2048 bytes for conntrackd and the NETLINK_BROADCAST_ERROR socket
flag, and generating lots of very small connections, I noticed
very few destroy entries on the fly waiting to be resend.
A simple way to test this patch consist of creating a lot of
entries, set a very small Netlink buffer in conntrackd (+ a patch
which is not in the git tree to set the BROADCAST_ERROR flag)
and invoke `conntrack -F'.
For expectations, no changes are introduced in this patch.
Currently, event delivery is only done for new expectations (no
events from expectation expiration, removal and confirmation).
In that case, they need a per-expectation event cache to implement
the same idea that is exposed in this patch.
This patch can be useful to provide reliable flow-accouting. We
still have to add a new conntrack extension to store the creation
and destroy time.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Patrick McHardy <kaber@trash.net>
2009-06-13 18:30:52 +08:00
|
|
|
unsigned int sysctl_events_retry_timeout;
|
2008-10-08 17:35:09 +08:00
|
|
|
int sysctl_acct;
|
2011-01-19 23:00:07 +08:00
|
|
|
int sysctl_tstamp;
|
2008-10-08 17:35:08 +08:00
|
|
|
int sysctl_checksum;
|
2008-10-08 17:35:08 +08:00
|
|
|
unsigned int sysctl_log_invalid; /* Log invalid packets */
|
2012-04-18 17:20:41 +08:00
|
|
|
int sysctl_auto_assign_helper;
|
|
|
|
|
bool auto_assign_helper_warned;
|
2012-05-29 05:04:10 +08:00
|
|
|
struct nf_ip_net nf_ct_proto;
|
2013-01-11 14:30:44 +08:00
|
|
|
#if defined(CONFIG_NF_CONNTRACK_LABELS)
|
|
|
|
|
unsigned int labels_used;
|
|
|
|
|
u8 label_words;
|
|
|
|
|
#endif
|
2012-08-27 01:14:06 +08:00
|
|
|
#ifdef CONFIG_NF_NAT_NEEDED
|
|
|
|
|
struct hlist_head *nat_bysource;
|
|
|
|
|
unsigned int nat_htable_size;
|
|
|
|
|
#endif
|
2008-10-08 17:35:08 +08:00
|
|
|
#ifdef CONFIG_SYSCTL
|
|
|
|
|
struct ctl_table_header *sysctl_header;
|
2008-10-08 17:35:09 +08:00
|
|
|
struct ctl_table_header *acct_sysctl_header;
|
2011-01-19 23:00:07 +08:00
|
|
|
struct ctl_table_header *tstamp_sysctl_header;
|
2009-06-13 18:26:29 +08:00
|
|
|
struct ctl_table_header *event_sysctl_header;
|
2012-04-18 17:20:41 +08:00
|
|
|
struct ctl_table_header *helper_sysctl_header;
|
2008-10-08 17:35:07 +08:00
|
|
|
#endif
|
2010-02-09 03:16:56 +08:00
|
|
|
char *slabname;
|
2008-10-08 17:35:02 +08:00
|
|
|
};
|
|
|
|
|
#endif
|