Hello tech@, first posting here so please don't laugh too hard.
My idea was to have pf automatically purge addresses from specified
tables after period of time from the insertion has gone by. The patch
is bare minimum but functional - adds the option "expire timeout",
(timeout parameter in seconds) to pf.conf table definitions.
After reading the source for quite some time and at the same time
writing this stuff, I can't quite decide on many things about the
implementation. If you see this is a bad thing to do to/in the kernel,
please let me know..
There are probably many flaws in the code and many more aspects I have
overlooked (probably some interference with something I haven't
stumbled upon in the source yet?). I'd appreciate some answers/pointers
to where to look at on these:
- timeouts (as state expiry and my original plan for 3.6 worked) vs.
- locking in the thread, do I need to rw_enter_write to safely delete
kentries with pfr_unroute_kentry() and pfr_destroy_kentry() - is this
even the correct method for removing addresses from tables or should I
use "higher" level functions? Or lower?
- cpu and memory implications: is it OK to add 4 bytes per table? I see
the structures are not used that much. This could build up in high
traffic/DoS situation, up to probably not-very-many k? The purge
"algorithm" surely is stupid, thinking about adding another time_second
stamp in pfr_ktable describing the next timeout and just testing that
before iterating every kentry in ktable, etc. The problem with these is
that development happens on a very low-end setup so I don't reach wire
speed anyways, but this would need to be working in a real-world
carp'ed fw setup to be installed soon. Routing between fastethernet
LANs where wire speed would be desirable.
- IOCTL - what's going on here? I've chosen not to update as it seems I
don't need to. But anyways I would like to do this right.
- many more ideas and todos that I'm only thinking about yet, not
knowing if all this code is just bad bs and pointless..
On Saturday 19 November 2005 22:17, you wrote:
> Hello tech@, first posting here so please don't laugh too hard.
> My idea was to have pf automatically purge addresses from specified
> tables after period of time from the insertion has gone by.
It might be worth to mention ports/sysutils/expiretable. Pretty much
the same functionality and also has a daemonised mode.