[PATCH 0/5] netfilter: nf_tables: set timeout support

[Patrick McHardy <kaber@trash.net>]

These patches add support for set timeouts. Sets can have a default
timeout value that can be overriden by element specific timeouts.

Removal of expired elements will usually be performed by a garbage
collector for two reasons: avoiding an excessive number of timers
and because data deinit has to happen in process context.

The first two patches add the required netlink attributes, parsing,
dump etc. A set of GC helper functions for batched RCU element
destruction is added in patch three, some synchronization helpers
to avoid races between async GC and netlink insertion and removal
of elements are added in patch four.

Following patches will use this infrastrucure to support set updates
from the packet classification path for dynamic sets and dynamic
flow state maintenance.

Please apply, thanks!


Patrick McHardy (5):
  netfilter: nf_tables: add set timeout API support
  netfilter: nf_tables: add set element timeout support
  netfilter: nf_tables: add set garbage collection helpers
  netfilter: nf_tables: add GC synchronization helpers
  netfilter: nft_hash: add support for timeouts

 include/net/netfilter/nf_tables.h        | 125 +++++++++++++++++++++++++++++++
 include/uapi/linux/netfilter/nf_tables.h |  10 +++
 net/netfilter/nf_tables_api.c            | 110 +++++++++++++++++++++++++--
 net/netfilter/nft_hash.c                 |  80 +++++++++++++++++++-
 4 files changed, 316 insertions(+), 9 deletions(-)

-- 
2.1.0