Re: [nft PATCH v3] List handles of added rules if requested

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, May 19, 2017 at 01:45:32PM +0200, Phil Sutter wrote:
> Being able to retrieve an added rule's handle atomically is a crucial
> feature for scripts invoking nft command: Without it, there is no way to
> be sure a handle extracted from 'nft list ruleset' command actually
> refers to the rule one has added before or that of another process which
> ran in between.
> 
> Extracting an added rule's handle itself is not an easy task already,
> since there is a chance that a given rule is printed differently than
> when it was added before. A simple example is port number vs. service
> name:
> 
> | nft add rule ip t c tcp dport { ssh, 80 } accept
> 
> There is no way to make 'nft list ruleset' return the rule just like
> this as depending on whether '-nn' was given or not, it either prints
> the set as '{ ssh, http }' or '{ 22, 80 }' but never in the mixed form
> that was used when adding it.
> 
> This patch adds the option to print an identifying string for each added
> rule which may be used as single parameter to a later 'nft delete rule'
> command. So a simple scripting example looks like this:
> 
> | handle=$(nft --echo add rule ip t c counter)
> | ...
> | nft delete rule $handle

Please, extend this so --echo consistently print the result for other
commands too. I prefer this works for all commands or none.

We should probably consider the introduction of unique handles to
table, chains, sets and objects at some point. Thus, you may request
to a specific version of the object, that if it is not available,
simply bail out. These handles would be printed with this --echo
option too.