[NETFILTER]: conntrack: add fixed timeout flag in connection tracking

Add a flag in a connection status to have a non updated timeout.
This permits to have connection that automatically die at a given
time.

Signed-off-by: Eric Leblond <eric@inl.fr>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 12 insertions, 0 deletions

diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index a297da7bbef5..4fe9e69378df 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -1130,6 +1130,12 @@ void __ip_ct_refresh_acct(struct ip_conntrack *ct,
 
         write_lock_bh(&ip_conntrack_lock);
 
+        /* Only update if this is not a fixed timeout */
+        if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status)) {
+                write_unlock_bh(&ip_conntrack_lock);
+                return;
+        }
+
         /* If not in hash table, timer will not be active yet */
         if (!is_confirmed(ct)) {
                 ct->timeout.expires = extra_jiffies;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index f9b83f91371a..bc2bd4c3859e 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1396,6 +1396,12 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
 
         write_lock_bh(&nf_conntrack_lock);
 
+        /* Only update if this is not a fixed timeout */
+        if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status)) {
+                write_unlock_bh(&nf_conntrack_lock);
+                return;
+        }
+
         /* If not in hash table, timer will not be active yet */
         if (!nf_ct_is_confirmed(ct)) {
                 ct->timeout.expires = extra_jiffies;