Hi,

I haven't tried the direct modprobe options - I didn't know how it might/may break how firewalld is using the module as a helper.

What I have done, as a workaround for now, is to put use '/etc/rc.d/rc.local' and put the command to change the sip_timeout option on the fly:

echo 300 > /sys/module/nf_conntrack_sip/parameters/sip_timeout

You need to make sure  '/etc/rc.d/rc.local' is executable:

chmod +x /etc/rc.d/rc.local

This seems to work as expected/desired and after a reboot the sip_timeout value is 300.

Cheers!

On Fri, 16 Feb 2024 at 14:24, Eric Garver <egarver@redhat.com> wrote:
On Fri, Feb 16, 2024 at 10:22:05AM +0000, solarmon wrote:
> Hi,
>
> I understand that the nf_conntrack_sip module is used as the helper module
> for the 'sip' service. I understand that firewalld loads up the modules
> using this modprobe config file:
>
> /etc/modprobe.d/firewalld-sysctls.conf

This file is about setting nf_conntrack* sysctls. It won't load any
extra modules.

> However, what I would like to do it set the nf_conntrack_sip 'sip_timeout'
> option value. The default is 3600 and this can be seen and set in
> realtime at:
>
> /sys/module/nf_conntrack_sip/parameters/sip_timeout
>
> However, I would like to get firewalld to set the sip_timeout value when it
> loads the module.
>
> I have tried create a specific modprobe config file
> at /etc/modprobe.d/50-nf_conntrack_sip.conf with the following contents:
>
> options nf_conntrack_sip sip_timeout=300

This looks correct to me.

> However, this does not seem to work and after a reboot,
> the /sys/module/nf_conntrack_sip/parameters/sip_timeout value is still 3600.
>
> Is there a way to specify the sip_timer option when defining the sip
> service in firewalld?

Ugh. There is no sysctl for sip_timeout so you're on the right track.
You must set it as a module option.

Does it work if you do it with modprobe?

  # modprobe -r nf_conntrack_sip
  # modprobe nf_conntrack_sip sip_timeout=300