[Nufw-devel] Re: [PATCH 1/3] [kernel patch] fixed duration connection

[Eric Leblond]

Patrick McHardy wrote:
> Eric Leblond wrote:
> 
>>I followed your recommendation and here's the patch.
> 
> 
> Seems you missed one in the noise :)

Here it is.

Thank you very much for your patience.

humm, google define:patience gives me :
        good-natured tolerance of delay or incompetence
Definition looks really good this time ;-)

BR,
--
Eric Leblond

diff --git a/include/linux/netfilter/nf_conntrack_common.h 
b/include/linux/netfilter/nf_conntrack_common.h
index 3ff88c8..68d282d 100644
--- a/include/linux/netfilter/nf_conntrack_common.h
+++ b/include/linux/netfilter/nf_conntrack_common.h
@@ -69,6 +69,11 @@ enum ip_conntrack_status {
        /* Connection is dying (removed from lists), can not be unset. */
        IPS_DYING_BIT = 9,
        IPS_DYING = (1 << IPS_DYING_BIT),
+
+    /* Connection has fixed timeout. */
+       IPS_FIXED_TIMEOUT_BIT = 10,
+       IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),
+
 };
 
 /* Connection tracking event bits */
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c 
b/net/ipv4/netfilter/ip_conntrack_core.c
index ceaabc1..b3d2f92 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -1130,6 +1130,10 @@ void __ip_ct_refresh_acct(struct ip_conn
 
        write_lock_bh(&ip_conntrack_lock);
 
+       /* Only update if this is not a fixed timeout */
+       if (! test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status))
+               return;
+
        /* If not in hash table, timer will not be active yet */
        if (!is_confirmed(ct)) {
                ct->timeout.expires = extra_jiffies;