Re: Re: Re: nft 'script' not working

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Oct 20, 2015 at 04:34:27PM +0200, giorgio.nicole@arcor.de wrote:
> Hi,
> 
> that's right but my main script fw_basic.nft should be a read only file;
> the dynamic behavior should result from the content of the included files
> at the end of the script.
> 
> ...
> include "/var/lib/nftables/user.nft"
> include "/var/lib/nftables/dnats.nft"
> 
> In my target system I have two configuration programs/daemons: the first
> generates the nft file '/var/lib/nftables/user.nft' with rules from the user, the
> second generates dnat rules (actually one rule with a set of multiple targets)
> on the basis of zeroconfig-found devices in the file '/var/lib/nftables/dnats.nft';
> 
> The main nft script then includes both the generated files actually implementing
> a dynamic firewall config.
> 
> This also works in case the user, for example, disables his part of the configuration:
> in this case the file '/var/lib/nftables/user.nft' will be empty and the next call to the script
> '/etc/nftable/fw_basic.nft' will actually (atomically) remove the user configs from the firewall.

Make sense.

Will ping you once I have push out the kernel patches to remove the
existing limitation on updating objects from the same batch, so you
have the chance to test it.

Thanks.