Fix Bug 5588 Add ability to modify conntrack expectation table size

* added 'firewall conntrack-expect-table-size' to modify expect table's size
* added 'firewall conntrack-hash-size' to set hash size for conntrack table

3 files changed, 66 insertions, 1 deletions

diff --git a/templates/firewall/conntrack-expect-table-size/node.def b/templates/firewall/conntrack-expect-table-size/node.def
new file mode 100644
index 0000000..12d7884
--- /dev/null
+++ b/templates/firewall/conntrack-expect-table-size/node.def
@@ -0,0 +1,34 @@
+#
+# Config template for: firewall conntrack-expect-table-size
+# 
+# This  is  the  table  of expectations.  Connection tracking expectations are 
+# the mechanism used to "expect" RELATED connections to existing ones.  
+# Expectations are generally used by "connection tracking helpers"  (sometimes 
+# called application level gateways [ALGs]) for more complex protocols such as
+# FTP, SIP, H.323. 
+#
+# default value when firewall is not set - 2048
+# default value when firewall is set - 4096
+#
+
+type: u32
+
+help: Set size of netfilter connection tracking expect table
+
+default: 4096
+
+comp_help:Possible completions:
+  <1 - 50000000>\tNumber of entries allowed in connection tracking expect table
+
+syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 50000000) ; "Value must be between 1 and 50,000,000"
+
+update:
+	sudo sh -c "echo $VAR(@) > \
+    	 		/proc/sys/net/netfilter/nf_conntrack_expect_max"
+
+
+
+
+
+
+
diff --git a/templates/firewall/conntrack-hash-size/node.def b/templates/firewall/conntrack-hash-size/node.def
new file mode 100644
index 0000000..0d11fae
--- /dev/null
+++ b/templates/firewall/conntrack-hash-size/node.def
@@ -0,0 +1,19 @@
+help: Set hash size for connection tracking table
+type: u32
+
+default: 4096
+
+comp_help:Possible completions:
+  <1 - 50000000>\tSize of hash to use for connection tracking table
+
+syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 50000000) ; "Value must be between 1 and 50,000,000"
+
+update:
+        if ! grep -q "nf_conntrack hashsize=$VAR(@)$" /etc/modprobe.d/vyatta_nf_conntrack
+        then
+          sudo sh -c "sed -i -e '/options nf_conntrack hashsize/d' \
+                /etc/modprobe.d/vyatta_nf_conntrack"
+          sudo sh -c "echo options nf_conntrack hashsize=$VAR(@) >> \
+                /etc/modprobe.d/vyatta_nf_conntrack"
+          echo "Updated conntrack hash size. This change will take affect when the system is rebooted."
+        fi
diff --git a/templates/firewall/node.def b/templates/firewall/node.def
index 3cdad32..daa8a51 100644
--- a/templates/firewall/node.def
+++ b/templates/firewall/node.def
@@ -1,6 +1,18 @@
 priority: 215
 help: Configure firewall
 
-delete: # set conntrack table size to standard 16384 entries if firewall disabled
+delete: # set conntrack table size to standard 16384 entries if fw disabled
         sudo sh -c "echo 16384 > /proc/sys/net/nf_conntrack_max"
 
+        # set conntrack expect table size to standard 2048 entries if fw disabled
+        sudo sh -c "echo 2048 > /proc/sys/net/netfilter/nf_conntrack_expect_max"
+
+	# set conntrack hash size to standard 4096
+        if ! grep -q "nf_conntrack hashsize=4096$" /etc/modprobe.d/vyatta_nf_conntrack
+        then
+          sudo sh -c "sed -i -e '/options nf_conntrack hashsize/d' \
+                /etc/modprobe.d/vyatta_nf_conntrack"
+          sudo sh -c "echo options nf_conntrack hashsize=4096 >> \
+                /etc/modprobe.d/vyatta_nf_conntrack"
+          echo "Conntrack hash size set to default 4096. This change will take affect when the system is rebooted."
+        fi