On Tue, Aug 26, 2014 at 01:09:54PM +0200, Pablo Neira Ayuso wrote: > Renaming the subject to make it to start a new discussion on something > related. Cc'ing Patrick too, perhaps he can pull some better idea out > of his hat. > > On Tue, Aug 26, 2014 at 11:57:16AM +0200, Arturo Borrero Gonzalez wrote: > > This code examples uses the new NFT_MSG_DELTABLE functionality to replace > > an entire ruleset in a single transaction/batch. > > Thanks for the example but we already have quite a lot of them, and > this is yet another almost copy and paste that would need to be > maintained. > > Please, implement this in nft. I think we can probably have an -x > option, eg. Agreed. The naive aproach seems to be something like this: - add a generation ID to the ruleset - dump the entire ruleset - generate delete commands for each existing rule/chain/set... - generate add commands for each new rule/chain/set... - send the entire thing to the kernel, including the generation ID - if the generation ID doesn't match, meaning the ruleset has changed since the last dump, return an error to userspace, retry -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
