On Thu, Nov 02, 2023 at 06:06:34PM +0100, Phil Sutter wrote:
> On Thu, Nov 02, 2023 at 04:29:34PM +0100, Thomas Haller wrote:
> > On Thu, 2023-11-02 at 16:03 +0100, Phil Sutter wrote:
> > >
> > > +# Note: Element expiry is no longer reset since kernel commit
> > > 4c90bba60c26
> > > +# ("netfilter: nf_tables: do not refresh timeout when resetting
> > > element"),
> > > +# the respective parts of the test have therefore been commented
> > > out.
> >
> > Hi Phil,
> >
> > do you expect that the old behavior ever comes back?
>
> A recent nfbz comment[1] from Pablo made me doubt the decision is final,
> though I may have misread it.
I hesitate on changing --stateless behaviour, but I don't find a
usecase for this option all alone unless it is combined with --terse,
to store an initial ruleset skeleton with no elements and no states.
Sets with timeout likely contain elements that get dynamically added
either via control plane or packet path based on some heuristics.
> > Why keep the old checks (commented out)? Maybe drop them? We can get it
> > from git history.
>
> Should the change be permanent, one should change the tests to assert
> the opposite, namely that expires values are unaffected by the reset.
I think it is fine as it is now in the kernel. I have posted patches
to allow to update element timeouts via transaction, which looks more
flexible and run through the transaction path. As for counter and
quota, users likely only want to either: 1) restore a previous state
(after reboot) or 2) dump-and-reset counters for stats collection
(e.g. fetch counters at the end of the day).
