Re: lnf_conntrack: nfct_cmp NFCT_CMP_TIMEOUT_* flags not supported?

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > So, my question is:
> > How are the NFCT_CMP_TIMEOUT flags supposed to be used?
> 
> They planned to be used by the conntrack utility. To obtain timers
> that are over/under some given timeout. But that was never
> implemented, so that code has remain untested there so far until
> someone has come to show some interest on it ;-).

Alright, I'll hold off with this change, then.
Problem is that this change:

> > diff --git a/src/conntrack/compare.c b/src/conntrack/compare.c
> > index b18f7fc..7cd28e7 100644
> > --- a/src/conntrack/compare.c
> > +++ b/src/conntrack/compare.c
> > @@ -407,5 +407,8 @@ int __compare(const struct nf_conntrack *ct1,
> >         if (flags & NFCT_CMP_REPL && !cmp_repl(ct1, ct2, flags))
> >                 return 0;
> >  
> > +       if (flags & (NFCT_CMP_TIMEOUT_GT|NFCT_CMP_TIMEOUT_LE))
> > +               return cmp_meta(ct1, ct2, flags);
> > +
> >         return 1;
> >  }

... is wrong after all.
IMO e.g. NFCT_CMP_TIMEOUT_EQ means that the comparision is valid
when the timeout is equal.  But above code means that its
valid when the timeout is equal AND all the other meta flags are
equal, too.  And thats very un-intuitive.

Regards,
Florian