Having expectations live past the master connection's lifetime

Having expectations live past the master connection's lifetime

[Kelvie Wong]

Hello all,

I have noticed that expectations seem to get deleted as soon as their
master connection finishes their TIME_WAIT. Is there any way to have
expectations outlive their masters?

I need to have a dynamic port open (for DCERPC), and the initial
connection to the endpoint mapper is typically short-lived.

The way I was going to do this was to just add a rule with iptables
using a userspace helper; is there a better way to do this?
-- 
Kelvie Wong

Re: Having expectations live past the master connection's lifetime

[Pablo Neira Ayuso]

On Thu, Jun 07, 2012 at 10:34:13AM -0700, Kelvie Wong wrote:
> Hello all,
> 
> I have noticed that expectations seem to get deleted as soon as their
> master connection finishes their TIME_WAIT. Is there any way to have
> expectations outlive their masters?

Not yet.

> I need to have a dynamic port open (for DCERPC), and the initial
> connection to the endpoint mapper is typically short-lived.
> 
> The way I was going to do this was to just add a rule with iptables
> using a userspace helper; is there a better way to do this?

We can skip removing these expectations by setting some flag in the
expectation. Still, we'll have to insert those expectations in some
list so we make sure that they are removed on module removal.

Another problem is that I cannot take that kernel patch if there's no
publicitly available Netfilter code using it.

Re: Having expectations live past the master connection's lifetime

[Kelvie Wong]

On Tue, Jun 12, 2012 at 10:56 AM, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> We can skip removing these expectations by setting some flag in the
> expectation. Still, we'll have to insert those expectations in some
> list so we make sure that they are removed on module removal.

Ah, I see. I think it would be easier to just insert an iptables rule
for what I want.

> Another problem is that I cannot take that kernel patch if there's no
> publicitly available Netfilter code using it.

That needn't be a problem, as I could probably add something, but I
think I'll just use iptables for this purpose.

Thanks for the reply, though.
-- 
Kelvie Wong