* nftable atomic rule replacement/update/restore?
@ 2014-01-20 21:10 Anders Berggren
2014-01-20 23:30 ` Patrick McHardy
0 siblings, 1 reply; 2+ messages in thread
From: Anders Berggren @ 2014-01-20 21:10 UTC (permalink / raw)
To: netfilter-devel
I apologise if this isn't the appropriate mailing list. Also, congratulations on the 3.13 inclusion, and 0.99 release!
After browsing the code I didn't find any atomic ruleset update/restore functionality, as described by http://marc.info/?l=netfilter-devel&m=135959066918397&w=2 and present in iptables-restore and possibly pfctl -f ...
If it's not currently implemented, I would suggest something like:
# nft -f myruleset
# cat rulesetset
table filter {
chain input {
type filter hook input priority 0;
ct state established accept
...
so that the user can have a nicely formated firewall configuration file, applied by a simple command.
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: nftable atomic rule replacement/update/restore?
2014-01-20 21:10 nftable atomic rule replacement/update/restore? Anders Berggren
@ 2014-01-20 23:30 ` Patrick McHardy
0 siblings, 0 replies; 2+ messages in thread
From: Patrick McHardy @ 2014-01-20 23:30 UTC (permalink / raw)
To: Anders Berggren; +Cc: netfilter-devel
On Mon, Jan 20, 2014 at 10:10:50PM +0100, Anders Berggren wrote:
> I apologise if this isn't the appropriate mailing list. Also, congratulations on the 3.13 inclusion, and 0.99 release!
>
> After browsing the code I didn't find any atomic ruleset update/restore functionality, as described by http://marc.info/?l=netfilter-devel&m=135959066918397&w=2 and present in iptables-restore and possibly pfctl -f ...
>
> If it's not currently implemented, I would suggest something like:
>
> # nft -f myruleset
> # cat rulesetset
> table filter {
> chain input {
> type filter hook input priority 0;
> ct state established accept
> ...
>
> so that the user can have a nicely formated firewall configuration file, applied by a simple command.--
Yeah, that's exactly what we do. Basically the ruleset you get by
nftables list table ... is formated like this and can be parsed using
nft -f.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-01-20 23:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-01-20 21:10 nftable atomic rule replacement/update/restore? Anders Berggren
2014-01-20 23:30 ` Patrick McHardy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).