From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick Schaaf Subject: Re: /etc/sysconfig/iptables format Date: Sun, 24 Nov 2002 12:52:52 +0100 Sender: netfilter-devel-admin@lists.netfilter.org Message-ID: <20021124115252.GD14672@oknodo.bof.de> References: <20021124104018.GC14672@oknodo.bof.de> <200211241328.57401.bdschuym@pandora.be> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netfilter-devel@lists.netfilter.org Return-path: To: Bart De Schuymer Content-Disposition: inline In-Reply-To: <200211241328.57401.bdschuym@pandora.be> Errors-To: netfilter-devel-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Unsubscribe: , List-Archive: List-Id: netfilter-devel.vger.kernel.org Hello Bart, > I'd like your opinion about the way ebtables makes atomically writing a > complete table to the kernel, possible. [description of "reference file manipulation" approach to construct tables] I like the scheme! May I have it for iptables, too, please? Why do I like it? Using the reference file, permits test-construction of an arbitrary rule set, with full rule consistency / error checking, and inspection of the result, without modifying the runtime rule set in any way. That's a great help when extending / modifying rule sets. With the current iptables, about the only sane alternative is to carefully construct a user mode linux instance mirroring your real system, and testing table construction there. The idea of applying all changes (optionally) to a reference file, saves big effort here. Part of why I like this, is the possibility to run the ruleset construction under an arbitrary uid. Only the final commit needs to be done as root. When your construction scripts become large that may be a great option, I think. I have a small proposal to augment the idea: as an alternative to specifying the reference file on the command line, could you define a "standard environment variable" which, when set, gives the name of the reference file to use? That way, one could run "rule set construction scripts" completely unchanged, i.e. without fiddling with the commandline of all the ??tables-commands in the scripts. Just give something different in the environment before calling the initial construction script. > One could say the file being binary is a problem. I don't think so. Having it binary, provides a rather strong hint that nothing but the delivered tools (ebtables, in your case) are supposed to understand the format. Doesn't raise futile expectations that way. best regards Patrick