Re: nftables add vs replace

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Jan 21, 2014 at 11:06:46AM +0000, Patrick McHardy wrote:
> We currently only support "add table" and "add chain" with NLM_F_EXCL.
> This means we can't replace entire tables without a lot of extra effort,
> also its not possible to create tables/chains just in case they don't
> already exist.
> 
> To fix this, I'd propose to add two new commands, so we have the following:
> 
> - add: add without NLM_F_EXCL
> - create: add with NLM_F_EXCL
> - replace: replace the entire thing

I guess you have in mind to simplify current reloading via nft -f.
Currently, we have to manually flush and delete chain/tables at this
moment, which is a bit of PITA.

> This most likely will also require updates to the transaction handling
> so we don't only process rules, but table, chain and set updates in a
> transaction.
>
> Comments?

It would be indeed nice if we handle table/chain updates in the same
batch like the rules. I think we can find a way to keep the current
.call hook there so we allow both table/chain updates via batch and
via simple independent commands.