From ef80caba204a6a27732748ce85563df94c39529e Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 28 Feb 2012 16:56:31 +0100
Subject: [PATCH] --- yaml --- r: 290815 b: refs/heads/master c:
 33ee44643f10638f0ce6a96d11e30d1fbe877024 h: refs/heads/master i:   290813:
 026f1ae3fe930a9aaa37f4ccf7f87ed40f559358   290811:
 fe5099227ff768f5e02fcc5c5da7b2ecc0c598bc   290807:
 653b9ca88ad41b99f744e5f5c0c50bf2945c1564   290799:
 c0e65afbda5ed6df6acb37463027b75d1ddde2c1   290783:
 2629bd630a1c1dd85e56e69f820b04480ed35db6   290751:
 5182bf94ac77568c224b28bcd146f0b6a07aae33   290687:
 9abc20e5497f7a49025740392c0f6f41a5bbc8b9   290559:
 fb5cd08d0a81d3f00e7f4621708ee20bdbf2d509   290303:
 64926f33b210766889075baf278f6e2e0d308dc7   289791:
 4d43e994fe92233a4b03ecb39a4c3f0544f97f83   288767:
 8bd0fe749c98e67ee4150b6eaf3b66f361413ec0   286719:
 66d4c0fd3b051803633a7e1f7e2fb3b66e0c2fe6 v: v3

---
 [refs]                                        |  2 +-
 .../linux/netfilter/nf_conntrack_tcp.h        |  5 +++-
 trunk/net/netfilter/nf_conntrack_proto_tcp.c  | 27 +++++++++----------
 3 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/[refs] b/[refs]
index 75ee9249883b..fd7b524d924c 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 5a41db94c60ac2a12b5a559de658a10d174b046d
+refs/heads/master: 33ee44643f10638f0ce6a96d11e30d1fbe877024
diff --git a/trunk/include/linux/netfilter/nf_conntrack_tcp.h b/trunk/include/linux/netfilter/nf_conntrack_tcp.h
index 6e135f97e59a..e59868ae12d4 100644
--- a/trunk/include/linux/netfilter/nf_conntrack_tcp.h
+++ b/trunk/include/linux/netfilter/nf_conntrack_tcp.h
@@ -18,7 +18,10 @@ enum tcp_conntrack {
 	TCP_CONNTRACK_LISTEN,	/* obsolete */
 #define TCP_CONNTRACK_SYN_SENT2	TCP_CONNTRACK_LISTEN
 	TCP_CONNTRACK_MAX,
-	TCP_CONNTRACK_IGNORE
+	TCP_CONNTRACK_IGNORE,
+	TCP_CONNTRACK_RETRANS,
+	TCP_CONNTRACK_UNACK,
+	TCP_CONNTRACK_TIMEOUT_MAX
 };
 
 /* Window scaling is advertised by the sender */
diff --git a/trunk/net/netfilter/nf_conntrack_proto_tcp.c b/trunk/net/netfilter/nf_conntrack_proto_tcp.c
index 97b9f3ebf28c..57c778546094 100644
--- a/trunk/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/trunk/net/netfilter/nf_conntrack_proto_tcp.c
@@ -64,13 +64,7 @@ static const char *const tcp_conntrack_names[] = {
 #define HOURS * 60 MINS
 #define DAYS * 24 HOURS
 
-/* RFC1122 says the R2 limit should be at least 100 seconds.
-   Linux uses 15 packets as limit, which corresponds
-   to ~13-30min depending on RTO. */
-static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly    =   5 MINS;
-static unsigned int nf_ct_tcp_timeout_unacknowledged __read_mostly =   5 MINS;
-
-static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
+static unsigned int tcp_timeouts[TCP_CONNTRACK_TIMEOUT_MAX] __read_mostly = {
 	[TCP_CONNTRACK_SYN_SENT]	= 2 MINS,
 	[TCP_CONNTRACK_SYN_RECV]	= 60 SECS,
 	[TCP_CONNTRACK_ESTABLISHED]	= 5 DAYS,
@@ -80,6 +74,11 @@ static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
 	[TCP_CONNTRACK_TIME_WAIT]	= 2 MINS,
 	[TCP_CONNTRACK_CLOSE]		= 10 SECS,
 	[TCP_CONNTRACK_SYN_SENT2]	= 2 MINS,
+/* RFC1122 says the R2 limit should be at least 100 seconds.
+   Linux uses 15 packets as limit, which corresponds
+   to ~13-30min depending on RTO. */
+	[TCP_CONNTRACK_RETRANS]		= 5 MINS,
+	[TCP_CONNTRACK_UNACK]		= 5 MINS,
 };
 
 #define sNO TCP_CONNTRACK_NONE
@@ -1015,12 +1014,12 @@ static int tcp_packet(struct nf_conn *ct,
 		ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
 
 	if (ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans &&
-	    tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans)
-		timeout = nf_ct_tcp_timeout_max_retrans;
+	    tcp_timeouts[new_state] > tcp_timeouts[TCP_CONNTRACK_RETRANS])
+		timeout = tcp_timeouts[TCP_CONNTRACK_RETRANS];
 	else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
 		 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
-		 tcp_timeouts[new_state] > nf_ct_tcp_timeout_unacknowledged)
-		timeout = nf_ct_tcp_timeout_unacknowledged;
+		 tcp_timeouts[new_state] > tcp_timeouts[TCP_CONNTRACK_UNACK])
+		timeout = tcp_timeouts[TCP_CONNTRACK_UNACK];
 	else
 		timeout = tcp_timeouts[new_state];
 	spin_unlock_bh(&ct->lock);
@@ -1301,14 +1300,14 @@ static struct ctl_table tcp_sysctl_table[] = {
 	},
 	{
 		.procname	= "nf_conntrack_tcp_timeout_max_retrans",
-		.data		= &nf_ct_tcp_timeout_max_retrans,
+		.data		= &tcp_timeouts[TCP_CONNTRACK_RETRANS],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
 		.procname	= "nf_conntrack_tcp_timeout_unacknowledged",
-		.data		= &nf_ct_tcp_timeout_unacknowledged,
+		.data		= &tcp_timeouts[TCP_CONNTRACK_UNACK],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,
@@ -1404,7 +1403,7 @@ static struct ctl_table tcp_compat_sysctl_table[] = {
 	},
 	{
 		.procname	= "ip_conntrack_tcp_timeout_max_retrans",
-		.data		= &nf_ct_tcp_timeout_max_retrans,
+		.data		= &tcp_timeouts[TCP_CONNTRACK_RETRANS],
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec_jiffies,