Use time_uptime for expiration values as time_second can be skewed at

runtime while time_uptime is monotonic. Prevent underflows in
pfsync(4) and pflow(4) by using signed variables.  pfsync(4) problem
pointed out by camield.

Diff originally by dlg, frag and pflow bits by me.

feedback dlg
man page tweak jmc

Various versions of the pflow bits tested by Hrvoje Popovski
(hrvoje AT srce DOT hr), thanks!

ok benno, henning, dlg

1 files changed, 9 insertions, 2 deletions

diff --git a/share/man/man4/pflow.4 b/share/man/man4/pflow.4
index 219851921af..8b0e74b8b75 100644
--- a/share/man/man4/pflow.4
+++ b/share/man/man4/pflow.4
@@ -1,4 +1,4 @@
-.\" $OpenBSD: pflow.4,v 1.13 2012/09/26 17:34:38 jmc Exp $
+.\" $OpenBSD: pflow.4,v 1.14 2012/10/30 12:09:05 florian Exp $
 .\"
 .\" Copyright (c) 2008 Henning Brauer <henning@openbsd.org>
 .\" Copyright (c) 2008 Joerg Goltermann <jg@osn.de>
@@ -15,7 +15,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: September 26 2012 $
+.Dd $Mdocdate: October 30 2012 $
 .Dt PFLOW 4
 .Os
 .Sh NAME
@@ -131,6 +131,13 @@ The
 device first appeared in
 .Ox 4.5 .
 .Sh BUGS
+A state created by
+.Xr pfsync 4
+can have a creation or expiration time before the machine came up.
+In this case,
+.Nm
+pretends such flows were created or expired when the machine came up.
+.Pp
 The IPFIX implementation is incomplete:
 The required transport protocol SCTP is not supported.
 Transport over TCP and DTLS protected flow export is also not supported.