On Tue, Jan 21, 2014 at 11:06:46AM +0000, Patrick McHardy wrote: > We currently only support "add table" and "add chain" with NLM_F_EXCL. > This means we can't replace entire tables without a lot of extra effort, > also its not possible to create tables/chains just in case they don't > already exist. > > To fix this, I'd propose to add two new commands, so we have the following: > > - add: add without NLM_F_EXCL > - create: add with NLM_F_EXCL > - replace: replace the entire thing I guess you have in mind to simplify current reloading via nft -f. Currently, we have to manually flush and delete chain/tables at this moment, which is a bit of PITA. > This most likely will also require updates to the transaction handling > so we don't only process rules, but table, chain and set updates in a > transaction. > > Comments? It would be indeed nice if we handle table/chain updates in the same batch like the rules. I think we can find a way to keep the current .call hook there so we allow both table/chain updates via batch and via simple independent commands. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
