diff mbox

netfilter: nf_ct_expect: partially implement ctnetlink_change_expect

Message ID 20120507164324.GA3824@kwong-desktop
State Accepted
Headers show

Commit Message

Kelvie Wong May 7, 2012, 4:43 p.m. UTC 
On Mon, May 07, 2012 at 09:28:58AM -0700, Kelvie Wong wrote:
> That will be fine.
> 
> Thank you,
> -- 
> Kelvie Wong

Here's the patch if you don't want to do the work :)

From 2fa0ea4c54ad8b16e7978f8d41892f4d33b0db65 Mon Sep 17 00:00:00 2001
From: Kelvie Wong <kelvie@ieee.org>
Date: Mon, 7 May 2012 09:30:55 -0700
Subject: [PATCH] netfilter: nf_ct_expect: partially implement
 ctnetlink_change_expect

This refreshes the "timeout" attribute in existing expectations if one is
given.

The use case for this would be for userspace helpers to extend the lifetime
of the expectation when requested, as this is not possible right now
without deleting/recreating the expectation.

I use this specifically for forwarding DCERPC traffic through:

DCERPC has a port mapper daemon that chooses a (seemingly) random port for
future traffic to go to. We expect this traffic (with a reasonable
timeout), but sometimes the port mapper will tell the client to continue
using the same port. This allows us to extend the expectation accordingly.

Signed-off-by: Kelvie Wong <kelvie@ieee.org>
---
 net/netfilter/nf_conntrack_netlink.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

Comments

Pablo Neira Ayuso May 7, 2012, 6:54 p.m. UTC | #1 
On Mon, May 07, 2012 at 09:43:24AM -0700, Kelvie Wong wrote:
> On Mon, May 07, 2012 at 09:28:58AM -0700, Kelvie Wong wrote:
> > That will be fine.
> > 
> > Thank you,
> > -- 
> > Kelvie Wong
> 
> Here's the patch if you don't want to do the work :)
> 
> From 2fa0ea4c54ad8b16e7978f8d41892f4d33b0db65 Mon Sep 17 00:00:00 2001
> From: Kelvie Wong <kelvie@ieee.org>
> Date: Mon, 7 May 2012 09:30:55 -0700
> Subject: [PATCH] netfilter: nf_ct_expect: partially implement
>  ctnetlink_change_expect
> 
> This refreshes the "timeout" attribute in existing expectations if one is
> given.
> 
> The use case for this would be for userspace helpers to extend the lifetime
> of the expectation when requested, as this is not possible right now
> without deleting/recreating the expectation.
> 
> I use this specifically for forwarding DCERPC traffic through:
> 
> DCERPC has a port mapper daemon that chooses a (seemingly) random port for
> future traffic to go to. We expect this traffic (with a reasonable
> timeout), but sometimes the port mapper will tell the client to continue
> using the same port. This allows us to extend the expectation accordingly.
> 
> Signed-off-by: Kelvie Wong <kelvie@ieee.org>

Applied, thanks Kelvie.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index ca7e835..57518fc 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2065,7 +2065,16 @@  static int
 ctnetlink_change_expect(struct nf_conntrack_expect *x,
 			const struct nlattr * const cda[])
 {
-	return -EOPNOTSUPP;
+	/* Refresh the timeout */
+	if (cda[CTA_EXPECT_TIMEOUT]) {
+		if (!del_timer(&x->timeout))
+			return -ETIME;
+
+		x->timeout.expires = jiffies +
+			ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
+		add_timer(&x->timeout);
+	}
+	return 0;
 }
 
 static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {