Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > On Fri, Jul 08, 2016 at 02:56:46PM +0200, Pablo Neira Ayuso wrote: > > On Wed, Jul 06, 2016 at 02:53:06PM +0200, Florian Westphal wrote: > > > We need to compute timeout.expires - jiffies, not the other way around. > > > Add a helper, another patch can then later change more places in > > > conntrack code where we currently open-code this. > > > > > > Will allow us to only change one place later when we remove per-ct timer. > > > > Applied, thanks. > > I just realized that this is broken from userspace, look: > > # nft --debug=netlink add rule x y ct expiration 10s > ip x y > [ ct load expiration => reg 1 ] > [ cmp eq reg 1 0x0000000a ] > > <cmdline>:1:1-30: Error: Could not process rule: No such file or > directory > add rule x y ct expiration 10s > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > jiffies_to_msecs() returns milliseconds, but userspace uses seconds. Ack, thanks for catching this. I only tested that 'ct expiration gt 0' was matching :-/ -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
