Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 294304e4 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: udp: set stream timeout to 2 minutes 



We have no explicit signal when a UDP stream has terminated, peers just
stop sending.

For suspected stream connections a timeout of two minutes is sane to keep
NAT mapping alive a while longer.

It matches tcp conntracks 'timewait' default timeout value.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d535c8a6

Documentation/networking/nf_conntrack-sysctl.txt

+1 −1
Original line number Diff line number Diff line
@@ -157,7 +157,7 @@ nf_conntrack_udp_timeout - INTEGER (seconds) 
	default 30



nf_conntrack_udp_timeout_stream - INTEGER (seconds)

	default 180

	default 120



	This extended timeout will be used in case there is an UDP stream

	detected.

net/netfilter/nf_conntrack_proto_udp.c

+1 −1
Original line number Diff line number Diff line
@@ -29,7 +29,7 @@ 


static const unsigned int udp_timeouts[UDP_CT_MAX] = {

	[UDP_CT_UNREPLIED]	= 30*HZ,

	[UDP_CT_REPLIED]	= 180*HZ,

	[UDP_CT_REPLIED]	= 120*HZ,

};



static unsigned int *udp_get_timeouts(struct net *net)