Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c8607e02 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_ct: fix expiration getter 



We need to compute timeout.expires - jiffies, not the other way around.
Add a helper, another patch can then later change more places in
conntrack code where we currently open-code this.

Will allow us to only change one place later when we remove per-ct timer.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 9cc1c73a

include/net/netfilter/nf_conntrack.h

+8 −0
Original line number Diff line number Diff line
@@ -284,6 +284,14 @@ static inline bool nf_is_loopback_packet(const struct sk_buff *skb) 
	return skb->dev && skb->skb_iif && skb->dev->flags & IFF_LOOPBACK;

}



/* jiffies until ct expires, 0 if already expired */

static inline unsigned long nf_ct_expires(const struct nf_conn *ct)

{

	long timeout = (long)ct->timeout.expires - (long)jiffies;



	return timeout > 0 ? timeout : 0;

}



struct kernel_param;



int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp);

net/netfilter/nft_ct.c

+1 −5
Original line number Diff line number Diff line
@@ -54,7 +54,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr, 
	const struct nf_conn_help *help;

	const struct nf_conntrack_tuple *tuple;

	const struct nf_conntrack_helper *helper;

	long diff;

	unsigned int state;



	ct = nf_ct_get(pkt->skb, &ctinfo);
@@ -94,10 +93,7 @@ static void nft_ct_get_eval(const struct nft_expr *expr, 
		return;

#endif

	case NFT_CT_EXPIRATION:

		diff = (long)jiffies - (long)ct->timeout.expires;

		if (diff < 0)

			diff = 0;

		*dest = jiffies_to_msecs(diff);

		*dest = jiffies_to_msecs(nf_ct_expires(ct));

		return;

	case NFT_CT_HELPER:

		if (ct->master == NULL)