Re: nf-next: netfilter: xt_recent: Add an entry reaper

[Patrick McHardy <kaber@trash.net>]

Tim Gardner wrote:
>>From f2b0624b159e3282d348cd045741725a64d71716 Mon Sep 17 00:00:00 2001
> From: Tim Gardner <tim.gardner@canonical.com>
> Date: Sat, 27 Feb 2010 20:22:07 -0700
> Subject: [PATCH] netfilter: xt_recent: Add an entry reaper (V4)
> 
> One of the problems with the way xt_recent is implemented is that
> there is no efficient way to remove expired entries. Of course,
> one can write a rule '-m recent --remove', but you have to know
> beforehand which entry to delete. This commit adds reaper
> logic which checks the head of the LRU list when a rule
> is invoked that has a '--seconds' value and XT_RECENT_REAP set. If an
> entry ceases to accumulate time stamps, then it will eventually bubble
> to the top of the LRU list where it is then reaped.

Thanks, this looks fine. My only concern is that we currently
don't catch unknown flags, so userspace won't get an error if
the option is used and the kernel doesn't support it. If you
document this clearly we can ignore it this one time, but I'd
appreciate if you could send me a patch on top to check for
unknown flags and refuse them.

> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

Applied, thanks.