Florian Westphal 0434ccdcf8 netfilter: nf_tables: rework ct timeout set support ... Using a private template is problematic: 1. We can't assign both a zone and a timeout policy (zone assigns a conntrack template, so we hit problem 1) 2. Using a template needs to take care of ct refcount, else we'll eventually free the private template due to ->use underflow. This patch reworks template policy to instead work with existing conntrack. As long as such conntrack has not yet been placed into the hash table (unconfirmed) we can still add the timeout extension. The only caveat is that we now need to update/correct ct->timeout to reflect the initial/new state, otherwise the conntrack entry retains the default 'new' timeout. Side effect of this change is that setting the policy must now occur from chains that are evaluated *after* the conntrack lookup has taken place. No released kernel contains the timeout policy feature yet, so this change should be ok. Changes since v2: - don't handle 'ct is confirmed case' - after previous patch, no need to special-case tcp/dccp/sctp timeout anymore Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2018-08-29 13:04:38 +02:00
..
ipv4	netfilter: conntrack: remove l3proto abstraction	2018-07-17 15:27:49 +02:00
ipv6	netfilter: add NAT support for shifted portmap ranges	2018-04-24 10:29:12 +02:00
br_netfilter.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nf_conntrack.h	netfilter: use kvmalloc_array to allocate memory for hashtable	2018-08-03 18:37:55 +02:00
nf_conntrack_acct.h	netfilter: introduce nf_conn_acct structure	2013-11-03 21:48:49 +01:00
nf_conntrack_core.h	netfilter: conntrack: remove l3proto abstraction	2018-07-17 15:27:49 +02:00
nf_conntrack_count.h	netfilter: nf_conncount: Add list lock and gc worker, and RCU for init tree search	2018-07-18 11:26:37 +02:00
nf_conntrack_ecache.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nf_conntrack_expect.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nf_conntrack_extend.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nf_conntrack_helper.h	netfilter: Remove useless param helper of nf_ct_helper_ext_add	2018-07-18 11:26:42 +02:00
nf_conntrack_l4proto.h	netfilter: remove ifdef around cttimeout in struct nf_conntrack_l4proto	2018-08-07 17:14:19 +02:00
nf_conntrack_labels.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nf_conntrack_seqadj.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nf_conntrack_synproxy.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nf_conntrack_timeout.h	netfilter: nf_tables: rework ct timeout set support	2018-08-29 13:04:38 +02:00
nf_conntrack_timestamp.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nf_conntrack_tuple.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nf_conntrack_zones.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nf_dup_netdev.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nf_flow_table.h	rhashtable: split rhashtable.h	2018-06-22 13:43:27 +09:00
nf_log.h	netfilter: check if the socket netns is correct.	2018-06-28 22:21:32 +09:00
nf_nat.h	netfilter: nf_nat: add nat hook register functions to nf_nat	2018-05-23 09:14:05 +02:00
nf_nat_core.h	netfilter: add struct nf_nat_hook and use it	2018-05-23 09:26:07 +02:00
nf_nat_helper.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nf_nat_l3proto.h	netfilter: nf_nat: add nat type hooks to nat core	2018-05-23 09:14:06 +02:00
nf_nat_l4proto.h	netfilter: add NAT support for shifted portmap ranges	2018-04-24 10:29:12 +02:00
nf_nat_redirect.h	netfilter: add NAT support for shifted portmap ranges	2018-04-24 10:29:12 +02:00
nf_queue.h	netfilter: core: remove synchronize_net call if nfqueue is used	2018-01-08 18:01:06 +01:00
nf_socket.h	netfilter: Decrease code duplication regarding transparent socket option	2018-06-03 00:02:01 +02:00
nf_tables.h	netfilter: nf_tables: fix register ordering	2018-08-16 19:37:02 +02:00
nf_tables_core.h	netfilter: nf_tables: handle meta/lookup with direct call	2018-07-30 11:52:02 +02:00
nf_tables_ipv4.h	netfilter: nf_tables_inet: don't use multihook infrastructure anymore	2018-01-08 18:01:20 +01:00
nf_tables_ipv6.h	netfilter: nf_tables_inet: don't use multihook infrastructure anymore	2018-01-08 18:01:20 +01:00
nf_tproxy.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2018-07-20 22:28:28 -07:00
nfnetlink_log.h	netfilter: xt_NFLOG: use nf_log_packet instead of nfulnl_log_packet.	2018-04-19 13:02:44 +02:00
nft_fib.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nft_masq.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nft_redir.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nft_reject.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xt_rateest.h	netfilter: make xt_rateest hash table per net	2018-03-05 23:15:44 +01:00