Re: [PATCH nf] netfilter: nf_tables: do not refresh timeout when resetting element

[Phil Sutter <phil@nwl.cc>]

On Mon, Oct 02, 2023 at 11:05:16AM +0200, Pablo Neira Ayuso wrote:
> The dump and reset command should not refresh the timeout, this command
> is intended to allow users to list existing stateful objects and reset
> them, element expiration should be refresh via transaction instead with
> a specific command to achieve this, otherwise this is entering combo
> semantics that will be hard to be undone later (eg. a user asking to
> retrieve counters but _not_ requiring to refresh expiration).

From a users' perspective, what is special about the element expires
value disqualifying it from being reset along with any counter/quota
values?

Do you have a PoC for set element reset via transaction yet? Can we
integrate non-timeout resets with it, too? Because IIUC, that's an
alternative to the pending reset locking.

What we have now is a broad 'reset element', not specifying what to
reset. If the above is a feature being asked for, I'd rather implement
'reset element counter', 'reset element timeout', 'reset element quota',
etc. commands.

Cheers, Phil