Hey Pablo, On Sun, May 6, 2012 at 4:09 PM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > You have to protect this with nf_conntrack_lock spinlock. See > net/netfilter/nf_conntrack_expect.c for expectation handling. ctnetlink_change_expect is not exported, and it is only called in ctnetlink_new_expect, which is protected by the spinlock. > >> return -EOPNOTSUPP; > > Now that we support expectation changing, this should be return 0. I can make this change. > We have two choices for this: > > a) rework the patch with the suggestion that I made. > b) add some NF_CT_EXPECT_FIXED_TIMEOUT flag like we have in the > connection tracking. Thus, the expectation will not ever expire. > > I'd need to know more about how you're using this. Depending on that, > we can select a) or b). I think we need to do a). A fixed timeout won't work, as in some cases we need to extend the expectation (the server has asked to use the same port again, so we need to give it another 10 minutes, possibly indefinitely), whereas in other cases we can just safely let the expectation expire. I want to avoid leaving the expectation forever, but I can't know until I see the DCERPC traffic. > > BTW, I'm working on finishing some user-space framework for developing > helper in user-space. My question is: would you be interested in > integrating your DCERPC helper into it? > > I expect to post some code soon, still working on it. I just need something to work right now (I'm going to use my original patch as-is, unless I made a grave error somewhere), but maybe in the future if it will ease maintenance. Thanks for your help! -- Kelvie Wong -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
