aboutsummaryrefslogtreecommitdiff
path: root/include/net
diff options
context:
space:
mode:
authorPatrick McHardy <kaber@trash.net>2007-07-07 22:33:47 -0700
committerDavid S. Miller <davem@sunset.davemloft.net>2007-07-10 22:17:59 -0700
commita71c085562bcc99e8b711cab4222bff1f6e955da (patch)
tree7de563d406e8e9e44065b53c664f837f97f8b3fe /include/net
parente9c1b084e17ca225b6be731b819308ee0f9e04b8 (diff)
[NETFILTER]: nf_conntrack: use hashtable for expectations
Currently all expectations are kept on a global list that - needs to be searched for every new conncetion - needs to be walked for evicting expectations when a master connection has reached its limit - needs to be walked on connection destruction for connections that have open expectations This is obviously not good, especially when considering helpers like H.323 that register *lots* of expectations and can set up permanent expectations, but it also allows for an easy DoS against firewalls using connection tracking helpers. Use a hashtable for expectations to avoid incurring the search overhead for every new connection. The default hash size is 1/256 of the conntrack hash table size, this can be overriden using a module parameter. This patch only introduces the hash table for expectation lookups and keeps other users to reduce the noise, the following patches will get rid of it completely. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net')
-rw-r--r--include/net/netfilter/nf_conntrack_core.h1
-rw-r--r--include/net/netfilter/nf_conntrack_expect.h5
2 files changed, 5 insertions, 1 deletions
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index a18f79c80db..4056f5f08da 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -84,7 +84,6 @@ print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
struct nf_conntrack_l4proto *proto);
extern struct hlist_head *nf_conntrack_hash;
-extern struct list_head nf_ct_expect_list;
extern rwlock_t nf_conntrack_lock ;
extern struct hlist_head unconfirmed;
diff --git a/include/net/netfilter/nf_conntrack_expect.h b/include/net/netfilter/nf_conntrack_expect.h
index cf6a619664e..424d4bdb984 100644
--- a/include/net/netfilter/nf_conntrack_expect.h
+++ b/include/net/netfilter/nf_conntrack_expect.h
@@ -7,12 +7,17 @@
#include <net/netfilter/nf_conntrack.h>
extern struct list_head nf_ct_expect_list;
+extern struct hlist_head *nf_ct_expect_hash;
+extern unsigned int nf_ct_expect_hsize;
struct nf_conntrack_expect
{
/* Internal linked list (global expectation list) */
struct list_head list;
+ /* Hash member */
+ struct hlist_node hnode;
+
/* We expect this tuple, with the following mask */
struct nf_conntrack_tuple tuple;
struct nf_conntrack_tuple_mask mask;