On Tue, Jan 21, 2014 at 12:27:00PM +0100, Pablo Neira Ayuso wrote: > On Tue, Jan 21, 2014 at 11:06:46AM +0000, Patrick McHardy wrote: > > We currently only support "add table" and "add chain" with NLM_F_EXCL. > > This means we can't replace entire tables without a lot of extra effort, > > also its not possible to create tables/chains just in case they don't > > already exist. > > > > To fix this, I'd propose to add two new commands, so we have the following: > > > > - add: add without NLM_F_EXCL > > - create: add with NLM_F_EXCL > > - replace: replace the entire thing > > I guess you have in mind to simplify current reloading via nft -f. > Currently, we have to manually flush and delete chain/tables at this > moment, which is a bit of PITA. Correct. It would also make creation of the predefined tables a lot less error prone. > > This most likely will also require updates to the transaction handling > > so we don't only process rules, but table, chain and set updates in a > > transaction. > > > > Comments? > > It would be indeed nice if we handle table/chain updates in the same > batch like the rules. I think we can find a way to keep the current > .call hook there so we allow both table/chain updates via batch and > via simple independent commands. Yes, that should be possible. We'd also need it for sets. I guess the semantics would be: - NLM_F_REPLACE: apply the entire batch to the newly created objects, IOW ignore everything that already exists in the table - !NLM_F_REPLACE: apply the batch to existing or new objects -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
