On Tue, Jun 01, 2010 at 10:29:10PM +0200, Pieter Smit wrote: > Radek, your problem is getting the rules into a standard format, where > you can match them to existing rules. > > Would a solution/workaround not be to > 1. create a dummy test chain/table not being used. > 2. add new rules to the chain/table (have to modify them slightly) 1 by 1 > 3. retrieve them in a standard form as provided by iptables-save -t test > 4. spend time in python routine to match and decide what to remove/update. > 5. make single insertion/replacement if needed. > 6. clear test table and start with next rule. Its not viable because I need also minimize the number of iptables operations. Another solution could be to dynamicaly load iptables extensions modules into my script and use somehow their parameter processing code if possible. Regards Radek Kanovsky -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
