netfilter: conntrack: udp: set stream timeout to 2 minutes

We have no explicit signal when a UDP stream has terminated, peers just
stop sending.

For suspected stream connections a timeout of two minutes is sane to keep
NAT mapping alive a while longer.

It matches tcp conntracks 'timewait' default timeout value.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/Documentation/networking/nf_conntrack-sysctl.txt b/Documentation/networking/nf_conntrack-sysctl.txt
index 1669dc2419fdcba80093a8cad13b4ab43ff14e03..e69b2e6a4a29428bd30c5ffda8bab88bb5ad5a5d 100644 (file)
--- a/Documentation/networking/nf_conntrack-sysctl.txt
+++ b/Documentation/networking/nf_conntrack-sysctl.txt
@@ -157,7 +157,7 @@ nf_conntrack_udp_timeout - INTEGER (seconds)
        default 30
 
 nf_conntrack_udp_timeout_stream - INTEGER (seconds)
-       default 180
+       default 120
 
        This extended timeout will be used in case there is an UDP stream
        detected.

diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 9f2e05adba69d999bebd0bf6fa47ac286b7f2c59..b4f5d5e82031cb6a3d5c82735930a92ba2ddcb32 100644 (file)
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -29,7 +29,7 @@
 
 static const unsigned int udp_timeouts[UDP_CT_MAX] = {
        [UDP_CT_UNREPLIED]      = 30*HZ,
-       [UDP_CT_REPLIED]        = 180*HZ,
+       [UDP_CT_REPLIED]        = 120*HZ,
 };
 
 static unsigned int *udp_get_timeouts(struct net *net)