Re: nftables add vs replace

[Patrick McHardy <kaber@trash.net>]

On Tue, Jan 21, 2014 at 12:27:00PM +0100, Pablo Neira Ayuso wrote:
> On Tue, Jan 21, 2014 at 11:06:46AM +0000, Patrick McHardy wrote:
> > We currently only support "add table" and "add chain" with NLM_F_EXCL.
> > This means we can't replace entire tables without a lot of extra effort,
> > also its not possible to create tables/chains just in case they don't
> > already exist.
> > 
> > To fix this, I'd propose to add two new commands, so we have the following:
> > 
> > - add: add without NLM_F_EXCL
> > - create: add with NLM_F_EXCL
> > - replace: replace the entire thing
> 
> I guess you have in mind to simplify current reloading via nft -f.
> Currently, we have to manually flush and delete chain/tables at this
> moment, which is a bit of PITA.

Correct. It would also make creation of the predefined tables a lot less
error prone.

> > This most likely will also require updates to the transaction handling
> > so we don't only process rules, but table, chain and set updates in a
> > transaction.
> >
> > Comments?
> 
> It would be indeed nice if we handle table/chain updates in the same
> batch like the rules. I think we can find a way to keep the current
> .call hook there so we allow both table/chain updates via batch and
> via simple independent commands.

Yes, that should be possible. We'd also need it for sets. I guess the
semantics would be:

- NLM_F_REPLACE: apply the entire batch to the newly created objects, IOW
  ignore everything that already exists in the table

- !NLM_F_REPLACE: apply the batch to existing or new objects