Is viewing a "candidate" ruleset in 'nft list ruleset' format possible?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

I'd like to know if it's possible tell 'nft' to load a ruleset from
file *without* applying it (a la 'nft -c -f <ruleset>) *but* also have
it show the parsed (yet unapplied) ruleset in 'nft list ruleset'
format as well?

I ask because I have a Bash script with a few helper functions for
nftables and one of the things I'd like to be able to do is to perform
a diff between a candidate ruleset and the last applied/current
ruleset. I can already do this by diffing the ruleset from file with
the last previously saved ruleset from file, but I'd like to be able
to (instead) compare the ruleset using the "cleaned up" format from
'nft list ruleset'. I just don't know how to generate a "candidate"
ruleset in that format without applying it to the kernel first (and
then it's not longer a "candidate", obviously).

Hopefully my question makes sense.

Thanks,
-Martin



[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux