Re: [PATCH nf] netfilter: nft_ct: fix expiration getter

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Fri, Jul 08, 2016 at 02:56:46PM +0200, Pablo Neira Ayuso wrote:
> > On Wed, Jul 06, 2016 at 02:53:06PM +0200, Florian Westphal wrote:
> > > We need to compute timeout.expires - jiffies, not the other way around.
> > > Add a helper, another patch can then later change more places in
> > > conntrack code where we currently open-code this.
> > >
> > > Will allow us to only change one place later when we remove per-ct timer.
> > 
> > Applied, thanks.
> 
> I just realized that this is broken from userspace, look:
> 
> # nft --debug=netlink add rule x y ct expiration 10s
> ip x y
>   [ ct load expiration => reg 1 ]
>   [ cmp eq reg 1 0x0000000a ]
> 
> <cmdline>:1:1-30: Error: Could not process rule: No such file or
> directory
> add rule x y ct expiration 10s
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> jiffies_to_msecs() returns milliseconds, but userspace uses seconds.

Ack, thanks for catching this.
I only tested that 'ct expiration gt 0' was matching :-/