Re: iptables-batch 2nd try

[Ludwig Nussel <ludwig.nussel@suse.de>]

Harald Welte wrote:
> On Wed, Apr 27, 2005 at 02:58:08PM +0200, Ludwig Nussel wrote:
> ...
> > +	fprintf(stderr, "Usage: %s [FILE]\n\n", program_name);
> > +	puts("Read iptables commands from FILE, commit them at EOF\n");
> > +	puts("In addition to normal iptables calls the commands");
> > +	puts("'commit' and 'exit' are understood.");
> > +	exit(0);
> 
> So why don't you put some simple parser/converter in front of
> iptables-restore?  I mean, iptables-restore does pretty much the same,
> just that it expects the input format to be something different than a
> shell script.
> 
> Those differences should be quite easy to convert (probably even in some
> shell or perl script).  Basically all you need to do is to remove the
> "iptables" from the beginning of the command, and add the COMMIT line at
> the end.  Even though "-P" and "-N" are not used.

That was my first approach but the startup costs for perl are too
high. So you'd need to write the converter in e.g. C. But then it
doesn't make much sense to print text that is parsed by
iptables-restore again when you can just do the appropriate calls
yourself. The disadvantage is that you need to build iptables-batch
inside iptables since there doesn't seem to be an external library.

> My main objective is that the functionality between iptables-restore and
> iptables-batch is pretty much the same.  I think either a converter
> before iptables-restore, or modifications to iptables-restore would be a
> better way.

There isn't much code to share between iptables-restore and
iptables-batch. Although the functionality is similar they work
differently.

cu
Ludwig

-- 
 (o_   Ludwig Nussel
 //\   SUSE LINUX Products GmbH, Development
 V_/_  http://www.suse.de/