Commit 76f12e63 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: ctnetlink: remove expired entries first 



When dumping conntrack table to userspace via ctnetlink, check if the ct has
already expired before doing any of the 'skip' checks.

This expires dead entries faster.
/proc handler also removes outdated entries first.

Reported-by: default avatarVitaly Zuevsky <vzuevsky@ns1.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent ebb966d3

net/netfilter/nf_conntrack_netlink.c

+3 −2
Original line number Diff line number Diff line
@@ -1195,8 +1195,6 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) 
		}

		hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[cb->args[0]],

					   hnnode) {

			if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)

				continue;

			ct = nf_ct_tuplehash_to_ctrack(h);

			if (nf_ct_is_expired(ct)) {

				if (i < ARRAY_SIZE(nf_ct_evict) &&
@@ -1208,6 +1206,9 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) 
			if (!net_eq(net, nf_ct_net(ct)))

				continue;



			if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)

				continue;



			if (cb->args[1]) {

				if (ct != last)

					continue;