diff options
| author |   Florian Westphal <fw@strlen.de> | 2018-12-18 00:05:29 +0100 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2018-12-21 00:48:46 +0100 |
| commit | 294304e4c522d797b7ea8200ab74354843fa68e9 (patch) | |
| tree | 14c5ed235dc6980f3b892f6717f0243564bf4b36 /net/netfilter/nf_conntrack_proto_udp.c | |
| parent | netfilter: conntrack: udp: only extend timeout to stream mode after 2s (diff) | |
| download | linux-dev-294304e4c522d797b7ea8200ab74354843fa68e9.tar.xz linux-dev-294304e4c522d797b7ea8200ab74354843fa68e9.zip | |
netfilter: conntrack: udp: set stream timeout to 2 minutes
We have no explicit signal when a UDP stream has terminated, peers just
stop sending.
For suspected stream connections a timeout of two minutes is sane to keep
NAT mapping alive a while longer.
It matches tcp conntracks 'timewait' default timeout value.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nf_conntrack_proto_udp.c')
| -rw-r--r-- | net/netfilter/nf_conntrack_proto_udp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c index 9f2e05adba69..b4f5d5e82031 100644 --- a/net/netfilter/nf_conntrack_proto_udp.c +++ b/net/netfilter/nf_conntrack_proto_udp.c @@ -29,7 +29,7 @@ static const unsigned int udp_timeouts[UDP_CT_MAX] = { [UDP_CT_UNREPLIED] = 30*HZ, - [UDP_CT_REPLIED] = 180*HZ, + [UDP_CT_REPLIED] = 120*HZ, }; static unsigned int *udp_get_timeouts(struct net *net) |