Re: iptables-batch 2nd try

[Ludwig Nussel <ludwig.nussel@suse.de>]

Harald Welte wrote:
> On Mon, May 09, 2005 at 10:56:03AM +0200, Ludwig Nussel wrote:
> > 
> > > My main objective is that the functionality between iptables-restore and
> > > iptables-batch is pretty much the same.  I think either a converter
> > > before iptables-restore, or modifications to iptables-restore would be a
> > > better way.
> > 
> > There isn't much code to share between iptables-restore and
> > iptables-batch. Although the functionality is similar they work
> > differently.
>  
> The question would then rather be: why is there no code share since the
> functionality is similar? ;)

Hmm. Both read a file line by line and split it into words.

iptables-batch then searches for -t to select the correct handle
that is passed to do_command(). Allocation of the handle is left to
do_command(). At EOF (or when reading "commit") it calls
iptc_commit() on each handle. That's it. If you want to flush tables
you have to add "iptables -F" lines yourself.

iptables-restore has a special syntax for manually creating a single
handle, creating chains and set their policy and for setting
counters. One needs to COMMIT before switching to another table. A
global setting determines whether all tables are flushed when a
handle for them is allocated.

So IMHO all that can be shared are some lines initialization
(getenv(), init_extensions()) and maybe the tokenizer. All the other
code would need to be inside a if(batch) {...} else if (restore){...}

cu
Ludwig

-- 
 (o_   Ludwig Nussel
 //\   SUSE LINUX Products GmbH, Development
 V_/_  http://www.suse.de/