From patchwork Mon May 7 16:43:24 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kelvie Wong X-Patchwork-Id: 157352 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id E7DF2B6EEB for ; Tue, 8 May 2012 02:43:33 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757082Ab2EGQnc (ORCPT ); Mon, 7 May 2012 12:43:32 -0400 Received: from mail-pb0-f46.google.com ([209.85.160.46]:49428 "EHLO mail-pb0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756659Ab2EGQnb (ORCPT ); Mon, 7 May 2012 12:43:31 -0400 Received: by pbbrp8 with SMTP id rp8so6886399pbb.19 for ; Mon, 07 May 2012 09:43:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; bh=37RZ7bFHaKki1Iw3+WPm3+Oe5aqhSGxQHofm9QppjvI=; b=xqCaBYaznoiNNLaMNo7ifpQBl2Mg/QyPJ63zdlirSjlbK7pJwLho8chxWbqZWTt8OL IaSiYDHS7YBNdvENI3oQ5ZYDJLqkNhKotqJNsK7pQ/ai6e0vbHLLAzAdqxviWHF4gIw7 GM38JQL1qESNehOQ0gfyyYZN1CJd5rsTVEa2/ecx9Bi1QcNqXh4JJHs0SrcA5GiXahue HFa3C/VNpOYfWyLayQTfYHh5psed8z2+pNo6rdVzy7zX9jW8ZRmtB2BoAOoJfV116kc+ sxZ5O7E7N4R15bLrViz41xWpGOKJsaerdAZdT+c4tTpEqc6llffdzlwFTkiSwhU+ow+q WWmw== Received: by 10.68.200.201 with SMTP id ju9mr2151903pbc.91.1336409011421; Mon, 07 May 2012 09:43:31 -0700 (PDT) Received: from kwong-desktop (served.by.wurldtech.com. [209.121.191.146]) by mx.google.com with ESMTPS id su3sm39741pbc.56.2012.05.07.09.43.29 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 07 May 2012 09:43:30 -0700 (PDT) Date: Mon, 7 May 2012 09:43:24 -0700 From: Kelvie Wong To: Pablo Neira Ayuso Cc: netfilter-devel@vger.kernel.org Subject: Re: [PATCH] netfilter: nf_ct_expect: partially implement ctnetlink_change_expect Message-ID: <20120507164324.GA3824@kwong-desktop> References: <1336005564-23171-1-git-send-email-kelvie@ieee.org> <1336005564-23171-3-git-send-email-kelvie@ieee.org> <20120506230915.GA23306@1984> <20120507084228.GA27334@1984> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org On Mon, May 07, 2012 at 09:28:58AM -0700, Kelvie Wong wrote: > That will be fine. > > Thank you, > -- > Kelvie Wong Here's the patch if you don't want to do the work :) From 2fa0ea4c54ad8b16e7978f8d41892f4d33b0db65 Mon Sep 17 00:00:00 2001 From: Kelvie Wong Date: Mon, 7 May 2012 09:30:55 -0700 Subject: [PATCH] netfilter: nf_ct_expect: partially implement ctnetlink_change_expect This refreshes the "timeout" attribute in existing expectations if one is given. The use case for this would be for userspace helpers to extend the lifetime of the expectation when requested, as this is not possible right now without deleting/recreating the expectation. I use this specifically for forwarding DCERPC traffic through: DCERPC has a port mapper daemon that chooses a (seemingly) random port for future traffic to go to. We expect this traffic (with a reasonable timeout), but sometimes the port mapper will tell the client to continue using the same port. This allows us to extend the expectation accordingly. Signed-off-by: Kelvie Wong --- net/netfilter/nf_conntrack_netlink.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index ca7e835..57518fc 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -2065,7 +2065,16 @@ static int ctnetlink_change_expect(struct nf_conntrack_expect *x, const struct nlattr * const cda[]) { - return -EOPNOTSUPP; + /* Refresh the timeout */ + if (cda[CTA_EXPECT_TIMEOUT]) { + if (!del_timer(&x->timeout)) + return -ETIME; + + x->timeout.expires = jiffies + + ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ; + add_timer(&x->timeout); + } + return 0; } static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {