netfilter: nf_tables: enable set expiration time for set elements

Browse source

Currently, the expiration of every element in a set or map
is a read-only parameter generated at kernel side.

This change will permit to set a certain expiration date
per element that will be required, for example, during
stateful replication among several nodes.

This patch handles the NFTA_SET_ELEM_EXPIRATION in order
to configure the expiration parameter per element, or
will use the timeout in the case that the expiration
is not set.

Signed-off-by: Laura Garcia Liebana <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Laura Garcia Liebana 2019-06-18 11:11:02 +02:00 • committed by Pablo Neira Ayuso

parent 2f0513d487

commit 79ebb5bb4e

3 changed files with 22 additions and 8 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

include/net/netfilter/nf_tables.h

View file

26

net/netfilter/nf_tables_api.c

View file

2

net/netfilter/nft_dynset.c

View file