On Tue, Aug 26, 2014 at 02:30:30PM +0100, Patrick McHardy wrote: > On 26. August 2014 14:12:57 GMT+01:00, Arturo Borrero Gonzalez <arturo.borrero.glez@xxxxxxxxx> wrote: > >On 26 August 2014 14:14, Patrick McHardy <kaber@xxxxxxxxx> wrote: > >> On Tue, Aug 26, 2014 at 01:09:54PM +0200, Pablo Neira Ayuso wrote: > >>> Renaming the subject to make it to start a new discussion on > >something > >>> related. Cc'ing Patrick too, perhaps he can pull some better idea > >out > >>> of his hat. > >>> > >>> On Tue, Aug 26, 2014 at 11:57:16AM +0200, Arturo Borrero Gonzalez > >wrote: > >>> > This code examples uses the new NFT_MSG_DELTABLE functionality to > >replace > >>> > an entire ruleset in a single transaction/batch. > >>> > >>> Thanks for the example but we already have quite a lot of them, and > >>> this is yet another almost copy and paste that would need to be > >>> maintained. > >>> > >>> Please, implement this in nft. I think we can probably have an -x > >>> option, eg. > >> > >> Agreed. The naive aproach seems to be something like this: > >> > >> - add a generation ID to the ruleset > >> - dump the entire ruleset > >> - generate delete commands for each existing rule/chain/set... > >> - generate add commands for each new rule/chain/set... > >> - send the entire thing to the kernel, including the generation ID > >> - if the generation ID doesn't match, meaning the ruleset has changed > >> since the last dump, return an error to userspace, retry > > > >The approach in my patchset is different: > > > >- generate a delete command that will flush all the previous ruleset > >- generate add commands for each new rule/chain/set/tables > >- send the batch to the kernel > > > >In this approach, we don't care about what is in the kernel previous > >to the delete command. > > Sure, but as Pablo pointed out, it adds more code that needs to be maintained that isn't strictly neccessary. Oh, I probably didn't explain well myself. I'd like to see Arturo's shortcut using _DELTABLE unless you have any concern with them :-). We still need that generation ID indeed to catch interferences between two object dumps, I'll send you a patch proposal for this soon. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
