netfilter: nf_conntrack: pass timeout array to l4->new and l4->packet

This patch defines a new interface for l4 protocol trackers:

unsigned int *(*get_timeouts)(struct net *net);

that is used to return the array of unsigned int that contains
the timeouts that will be applied for this flow. This is passed
to the l4proto->new(...) and l4proto->packet(...) functions to
specify the timeout policy.

This interface allows per-net global timeout configuration
(although only DCCP supports this by now) and it will allow
custom custom timeout configuration by means of follow-up
patches.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 10 insertions, 3 deletions

diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index ab5b27a2916f..6b801124b31f 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -75,25 +75,31 @@ static int icmp_print_tuple(struct seq_file *s,
                           ntohs(tuple->src.u.icmp.id));
 }
 
+static unsigned int *icmp_get_timeouts(struct net *net)
+{
+        return &nf_ct_icmp_timeout;
+}
+
 /* Returns verdict for packet, or -1 for invalid. */
 static int icmp_packet(struct nf_conn *ct,
                        const struct sk_buff *skb,
                        unsigned int dataoff,
                        enum ip_conntrack_info ctinfo,
                        u_int8_t pf,
-                       unsigned int hooknum)
+                       unsigned int hooknum,
+                       unsigned int *timeout)
 {
         /* Do not immediately delete the connection after the first
            successful reply to avoid excessive conntrackd traffic
            and also to handle correctly ICMP echo reply duplicates. */
-        nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_icmp_timeout);
+        nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
 
         return NF_ACCEPT;
 }
 
 /* Called when a new connection for this protocol found. */
 static bool icmp_new(struct nf_conn *ct, const struct sk_buff *skb,
-                     unsigned int dataoff)
+                     unsigned int dataoff, unsigned int *timeouts)
 {
         static const u_int8_t valid_new[] = {
                 [ICMP_ECHO] = 1,
@@ -298,6 +304,7 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp __read_mostly =
         .invert_tuple           = icmp_invert_tuple,
         .print_tuple            = icmp_print_tuple,
         .packet                 = icmp_packet,
+        .get_timeouts           = icmp_get_timeouts,
         .new                    = icmp_new,
         .error                  = icmp_error,
         .destroy                = NULL,