Skip to content
  • Josh Hunt's avatar
    netfilter: ipset: add forceadd kernel support for hash set types · 07cf8f5a
    Josh Hunt authored
    
    
    Adds a new property for hash set types, where if a set is created
    with the 'forceadd' option and the set becomes full the next addition
    to the set may succeed and evict a random entry from the set.
    
    To keep overhead low eviction is done very simply. It checks to see
    which bucket the new entry would be added. If the bucket's pos value
    is non-zero (meaning there's at least one entry in the bucket) it
    replaces the first entry in the bucket. If pos is zero, then it continues
    down the normal add process.
    
    This property is useful if you have a set for 'ban' lists where it may
    not matter if you release some entries from the set early.
    
    Signed-off-by: default avatarJosh Hunt <johunt@akamai.com>
    Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    07cf8f5a