Re: /etc/sysconfig/iptables format

[Patrick Schaaf <bof@bof.de>]

Hello Bart,

> I'd like your opinion about the way ebtables makes atomically writing a 
> complete table to the kernel, possible.
[description of "reference file manipulation" approach to construct tables]

I like the scheme! May I have it for iptables, too, please?

Why do I like it? Using the reference file, permits test-construction
of an arbitrary rule set, with full rule consistency / error checking,
and inspection of the result, without modifying the runtime rule set
in any way. That's a great help when extending / modifying rule sets.
With the current iptables, about the only sane alternative is to
carefully construct a user mode linux instance mirroring your real
system, and testing table construction there. The idea of applying
all changes (optionally) to a reference file, saves big effort here.

Part of why I like this, is the possibility to run the ruleset
construction under an arbitrary uid. Only the final commit needs
to be done as root. When your construction scripts become large
that may be a great option, I think.

I have a small proposal to augment the idea: as an alternative to
specifying the reference file on the command line, could you define
a "standard environment variable" which, when set, gives the name
of the reference file to use? That way, one could run "rule set
construction scripts" completely unchanged, i.e. without fiddling
with the commandline of all the ??tables-commands in the scripts.
Just give something different in the environment before calling
the initial construction script.

> One could say the file being binary is a problem.

I don't think so. Having it binary, provides a rather strong hint that
nothing but the delivered tools (ebtables, in your case) are supposed
to understand the format. Doesn't raise futile expectations that way.

best regards
  Patrick