netdev - Re: [PATCH net v2 1/2] netfilter: conntrack: Move nf_ct_offload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <624429ca-5d63-78d4-f4df-c1fb53a409c0@mellanox.com>
Date:   Mon, 3 Aug 2020 16:15:16 +0300
From:   Roi Dayan <roid@...lanox.com>
To:     Pablo Neira Ayuso <pablo@...filter.org>
Cc:     netdev@...r.kernel.org, Paul Blakey <paulb@...lanox.com>,
        Oz Shlomo <ozsh@...lanox.com>,
        Marcelo Ricardo Leitner <mleitner@...hat.com>
Subject: Re: [PATCH net v2 1/2] netfilter: conntrack: Move
 nf_ct_offload_timeout to header file



On 2020-08-03 2:03 PM, Pablo Neira Ayuso wrote:
> On Mon, Aug 03, 2020 at 10:33:04AM +0300, Roi Dayan wrote:
>> To be used by callers from other modules.
>>
>> Signed-off-by: Roi Dayan <roid@...lanox.com>
>> Reviewed-by: Oz Shlomo <ozsh@...lanox.com>
>> ---
>>  include/net/netfilter/nf_conntrack.h | 12 ++++++++++++
>>  net/netfilter/nf_conntrack_core.c    | 12 ------------
>>  2 files changed, 12 insertions(+), 12 deletions(-)
>>
>> diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
>> index 90690e37a56f..8481819ff632 100644
>> --- a/include/net/netfilter/nf_conntrack.h
>> +++ b/include/net/netfilter/nf_conntrack.h
>> @@ -279,6 +279,18 @@ static inline bool nf_ct_should_gc(const struct nf_conn *ct)
>>  	       !nf_ct_is_dying(ct);
>>  }
>>  
>> +#define	DAY	(86400 * HZ)
>> +
>> +/* Set an arbitrary timeout large enough not to ever expire, this save
>> + * us a check for the IPS_OFFLOAD_BIT from the packet path via
>> + * nf_ct_is_expired().
>> + */
>> +static inline void nf_ct_offload_timeout(struct nf_conn *ct)
>> +{
>> +	if (nf_ct_expires(ct) < DAY / 2)
>> +		ct->timeout = nfct_time_stamp + DAY;
>> +}
>> +
>>  struct kernel_param;
>>  
> 
> For the record: I have renamed DAY to NF_CT_DAY to avoid a possible
> symbol name clash. No need to resend, I applied this small change
> before applying.
> 

thanks