Re: [PATCH v3 1/2] scanner: add support for include directories

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Jun 06, 2017 at 05:58:24PM +0200, Pablo Neira Ayuso wrote:
> On Tue, Jun 06, 2017 at 02:50:09PM +0300, Ismo Puustinen wrote:
> > If a string after "include" keyword points to a directory instead of a
> > file, consider the directory to contain only nft rule files and try to
> > load them all. This helps with a use case where services drop their own
> > firewall configuration files into a directory and nft needs to include
> > those without knowing the exact file names.
> > 
> > File loading order from the include directory is not specified, so the
> > files inside an include directory should not depend on each other.
> > 
> > Fixes(Bug 1154 - Allow include statement to operate on directories and/or wildcards).
> 
> Applied, thanks Ismo.
> 
> BTW, it would be great if you can send us a patch for the nft(8)
> manpage too to document this new feature.
> 
> I can also create an account for your at wiki.nftables.org, in case
> you want to add there more examples. There are people even slightly
> describing their usecase and the way they are solving it. These
> patterns will be good for people that are looking into reusing good
> ideas when using nftables.

BTW, one more question: I still have a minor concern on the
assumptions that people can made on the order that files are included
in this feature.

Please, correct me if wrong, my understanding is at this stage there
is not guarantees in what order they would be loaded at all.

So I'm thinking that it would be good if we provide some good
default, ie. load them in alphanumeric order or similar.

That would be a follow up patch, but it would be good to sort out this
before nft 0.8 gets released.

Thanks!