From: Florian Westphal <fw@strlen.de>
To: Phil Sutter <phil@nwl.cc>, Florian Westphal <fw@strlen.de>,
netfilter-devel@vger.kernel.org
Subject: Re: [iptables-nft RFC 1/5] nft-shared: dump errors on stdout to garble output
Date: Wed, 23 Nov 2022 13:50:32 +0100 [thread overview]
Message-ID: <20221123125032.GA2753@breakpoint.cc> (raw)
In-Reply-To: <Y30NJTaQx8Wn7RLE@orbyte.nwl.cc>
Phil Sutter <phil@nwl.cc> wrote:
> What I don't like about this is that users won't notice the problem
> until they try to restore the ruleset. For us it is clearly beneficial
> to see where things break, but I doubt regular users care and we should
> just tell them to stop mixing iptables and nft calls.
So what would you propose...?
> Can we maybe add "--force" to iptables-nft-save to make it print as much
> as possible despite the table being considered incompatible? Not sure
> how ugly this is to implement, though.
I don't see this as useful thing because we already have "nft --debug=netlink".
> We still exit(0) in case parsing fails, BTW. Guess this is the most
> important thing to fix despite all the above.
Huh?
iptables-restore < bla
iptables-restore v1.8.8 (nf_tables): unknown option "--bla"
Error occurred at line: 7 Try `iptables-restore -h' or 'iptables-restore --help' for more information.
... exits with 2.
Can you give an example?
next prev parent reply other threads:[~2022-11-23 13:08 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-21 11:19 [iptables-nft RFC 0/5] update iptables-nft dissector Florian Westphal
2022-11-21 11:19 ` [iptables-nft RFC 1/5] nft-shared: dump errors on stdout to garble output Florian Westphal
2022-11-22 17:55 ` Phil Sutter
2022-11-23 12:50 ` Florian Westphal [this message]
2022-11-23 13:13 ` Phil Sutter
2022-11-23 13:27 ` Florian Westphal
2022-11-23 13:34 ` Phil Sutter
2022-11-21 11:19 ` [iptables-nft RFC 2/5] iptables-nft: do not refuse to decode table with unsupported expressions Florian Westphal
2022-11-21 11:19 ` [iptables-nft RFC 3/5] nft: check for unknown meta keys Florian Westphal
2022-11-21 11:19 ` [iptables-nft RFC 4/5] xlate-test: extra-escape of '"' for replay mode Florian Westphal
2022-11-22 15:51 ` Phil Sutter
2022-11-22 16:01 ` Florian Westphal
2022-11-22 16:22 ` Phil Sutter
2022-11-23 9:31 ` Florian Westphal
2022-11-23 9:57 ` Phil Sutter
2022-11-21 11:19 ` [iptables-nft RFC 5/5] generic.xlate: make one replay test case work Florian Westphal
2022-11-22 16:16 ` Phil Sutter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221123125032.GA2753@breakpoint.cc \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=phil@nwl.cc \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).