Re: [PATCH] Conntrack proc interface for tuple removal

[Pablo Neira <pablo@eurodev.net>]

Ferry Huberts wrote:
> I badly needed to be able to remove conntrack tuple because of some very
> dynamic application behaviour, so I wrote a patch.
> Hope it lives up to your standards, I find it quite usefull :-)
> 
> The patch is based on work from Yutaka Kondo.
> 
> The patch is against 2.4.30 since that is the kernel I'm using, haven't
> looked into applying it against 2.6.x.y

You should do this with ctnetlink. It actually provides a more flexible 
interface to user space applications: I mean, more actions like 
creation, update, deletion, whatever... instead of doing this via /proc. 
Have a look at the conntrack tool in netfilter SVN.

BTW, some comments about your patch:

- READ_LOCK'ing while trying to delete a conntrack is racy, you must use 
write_lock instead. Someone else could be reading the conntrack table 
while you try to delete a conntrack.
- check the value returned by del_timer, currently racy as well.
- Deadlock on SMP: calling conntrack->timeout.function 
(death_by_timeout) is illegal if you've got ip_conntrack_lock.

--
Pablo