Files
kernel_arpi/include/net
Florian Westphal d535c8a69c netfilter: conntrack: udp: only extend timeout to stream mode after 2s
Currently DNS resolvers that send both A and AAAA queries from same source port
can trigger stream mode prematurely, which results in non-early-evictable conntrack entry
for three minutes, even though DNS requests are done in a few milliseconds.

Add a two second grace period where we continue to use the ordinary
30-second default timeout.  Its enough for DNS request/response traffic,
even if two request/reply packets are involved.

ASSURED is still set, else conntrack (and thus a possible
NAT mapping ...) gets zapped too in case conntrack table runs full.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-12-21 00:48:38 +01:00
..
2018-09-08 01:39:47 +09:00
2018-01-19 14:02:12 -05:00
2018-09-18 19:55:01 -07:00
2018-10-31 12:37:12 -07:00
2018-05-16 07:23:35 +02:00
2018-09-26 20:22:19 -07:00
2018-07-30 09:10:25 -07:00
2018-02-28 11:43:28 -05:00
2018-04-23 10:21:24 -04:00
2017-10-11 09:49:34 +02:00
2018-11-07 23:00:23 -08:00
2017-12-11 14:10:06 -05:00
2018-11-07 16:23:05 -08:00
2018-09-13 09:04:58 -07:00
2018-04-07 22:32:31 -04:00
2017-11-08 16:12:33 +09:00
2018-09-25 20:17:35 -07:00
2017-12-05 14:37:13 -05:00
2018-05-16 07:23:35 +02:00
2018-06-22 13:43:27 +09:00
2018-06-22 13:43:27 +09:00
2018-10-23 10:57:06 -07:00
2018-08-29 12:25:53 -07:00