Re: [PATCH 0/5] netfilter: nf_tables: set timeout support

[Patrick McHardy <kaber@trash.net>]

On 02.04, Pablo Neira Ayuso wrote:
> On Thu, Mar 26, 2015 at 12:39:35PM +0000, Patrick McHardy wrote:
> > These patches add support for set timeouts. Sets can have a default
> > timeout value that can be overriden by element specific timeouts.
> > 
> > Removal of expired elements will usually be performed by a garbage
> > collector for two reasons: avoiding an excessive number of timers
> > and because data deinit has to happen in process context.
> > 
> > The first two patches add the required netlink attributes, parsing,
> > dump etc. A set of GC helper functions for batched RCU element
> > destruction is added in patch three, some synchronization helpers
> > to avoid races between async GC and netlink insertion and removal
> > of elements are added in patch four.
> > 
> > Following patches will use this infrastrucure to support set updates
> > from the packet classification path for dynamic sets and dynamic
> > flow state maintenance.
> > 
> > Please apply, thanks!
> 
> Series applied, thanks Patrick.

Thanks, I'll send the next batch soon.

> BTW, what's your plan with the rbtree and timeouts?

No specific plans so far. It would be fairly easy to add them, however
we'll always chose nft_hash unless intervals are used anyway, and in
that case it doesn't make too much sense to have timeouts as long
as we have no real knowledge of intervals within the kernel.