Florian Westphal f330a7fdbe netfilter: conntrack: get rid of conntrack timer ... With stats enabled this eats 80 bytes on x86_64 per nf_conn entry, as Eric Dumazet pointed out during netfilter workshop 2016. Eric also says: "Another reason was the fact that Thomas was about to change max timer range [..]" (500462a9de, 'timers: Switch to a non-cascading wheel'). Remove the timer and use a 32bit jiffies value containing timestamp until entry is valid. During conntrack lookup, even before doing tuple comparision, check the timeout value and evict the entry in case it is too old. The dying bit is used as a synchronization point to avoid races where multiple cpus try to evict the same entry. Because lookup is always lockless, we need to bump the refcnt once when we evict, else we could try to evict already-dead entry that is being recycled. This is the standard/expected way when conntrack entries are destroyed. Followup patches will introduce garbage colliction via work queue and further places where we can reap obsoleted entries (e.g. during netlink dumps), this is needed to avoid expired conntracks from hanging around for too long when lookup rate is low after a busy period. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2016-08-30 11:43:09 +02:00
..
ipv4	…
ipv6	…
br_netfilter.h	…
nf_conntrack.h	netfilter: conntrack: get rid of conntrack timer	2016-08-30 11:43:09 +02:00
nf_conntrack_acct.h	…
nf_conntrack_core.h	netfilter: conntrack: simplify the code by using nf_conntrack_get_ht	2016-08-18 01:20:52 +02:00
nf_conntrack_ecache.h	netfilter: don't rely on DYING bit to detect when destroy event was sent	2016-08-30 11:43:08 +02:00
nf_conntrack_expect.h	…
nf_conntrack_extend.h	netfilter: move nat hlist_head to nf_conn	2016-07-11 11:47:50 +02:00
nf_conntrack_helper.h	netfilter: Add helper array register/unregister functions	2016-07-21 02:31:53 +02:00
nf_conntrack_l3proto.h	…
nf_conntrack_l4proto.h	netfilter: remove ip_conntrack* sysctl compat code	2016-08-13 13:27:13 +02:00
nf_conntrack_labels.h	netfilter: connlabels: move set helper to xt_connlabel	2016-07-22 17:05:10 +02:00
nf_conntrack_seqadj.h	…
nf_conntrack_synproxy.h	…
nf_conntrack_timeout.h	…
nf_conntrack_timestamp.h	…
nf_conntrack_tuple.h	…
nf_conntrack_zones.h	…
nf_dup_netdev.h	…
nf_log.h	…
nf_nat.h	netfilter: nat: convert nat bysrc hash to rhashtable	2016-07-11 12:07:57 +02:00
nf_nat_core.h	…
nf_nat_helper.h	…
nf_nat_l3proto.h	…
nf_nat_l4proto.h	…
nf_nat_redirect.h	…
nf_queue.h	…
nf_tables.h	netfilter: nf_tables: honor NLM_F_EXCL flag in set element insertion	2016-08-26 17:30:20 +02:00
nf_tables_bridge.h	…
nf_tables_core.h	…
nf_tables_ipv4.h	…
nf_tables_ipv6.h	…
nfnetlink_log.h	…
nft_dup.h	…
nft_masq.h	…
nft_meta.h	…
nft_redir.h	…
nft_reject.h	…
xt_rateest.h	…