Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > So, my question is: > > How are the NFCT_CMP_TIMEOUT flags supposed to be used? > > They planned to be used by the conntrack utility. To obtain timers > that are over/under some given timeout. But that was never > implemented, so that code has remain untested there so far until > someone has come to show some interest on it ;-). Alright, I'll hold off with this change, then. Problem is that this change: > > diff --git a/src/conntrack/compare.c b/src/conntrack/compare.c > > index b18f7fc..7cd28e7 100644 > > --- a/src/conntrack/compare.c > > +++ b/src/conntrack/compare.c > > @@ -407,5 +407,8 @@ int __compare(const struct nf_conntrack *ct1, > > if (flags & NFCT_CMP_REPL && !cmp_repl(ct1, ct2, flags)) > > return 0; > > > > + if (flags & (NFCT_CMP_TIMEOUT_GT|NFCT_CMP_TIMEOUT_LE)) > > + return cmp_meta(ct1, ct2, flags); > > + > > return 1; > > } ... is wrong after all. IMO e.g. NFCT_CMP_TIMEOUT_EQ means that the comparision is valid when the timeout is equal. But above code means that its valid when the timeout is equal AND all the other meta flags are equal, too. And thats very un-intuitive. Regards, Florian -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
