Re: [PATCH nf-next v2] netfilter: conntrack: collect start time as early as possible

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Nov 05, 2024 at 05:33:08PM +0100, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > It will help for SEEN_REPLY.  But I don't see how it will avoid this
> > > patch.
> > 
> > Not current time from ctnetlink, but use the ecache extension to store
> > the timestamp when the conntrack is allocated, ecache is already
> > initialized from init_conntrack() path.
> 
> OK, so we do ktime_get_real() twice.
> I think its way worse than this proposal, but okay.

My proposal is to add more well-known "fixed points" to get numbers.
At this stage, there is start= and stop= ktimestamps, where start=
represents insertion to hashes (confirmation time). I think this adds
more ktimestamp point that can be enabled to collect numbers in an
optional fashion, both two timestamps do not need to be turned on
necessarily.

> I'll work on this.

Thanks, I'd rather convince you this is the way to go, if after
quickly sketching a patchset you think it is not worth for more
reasons, we can revisit.