From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Eric <evil.function@proton.me>
Cc: George Shuklin <george.shuklin@gmail.com>, netfilter@vger.kernel.org
Subject: Re: Processing nftable rules without loading them into the kernel
Date: Mon, 10 Jul 2023 09:39:04 +0200 [thread overview]
Message-ID: <ZKu1mF2S4dxhH3vj@calendula> (raw)
In-Reply-To: <DCRE19RgCyYzfyvb4gv3bKsN5oCut4gnJz4RbbOZ9xboIv61XcIxVf4M-7lNixc60MbBeJ6ni2G1a_fBHpsDjJ0MqVkzxTAh5SGFKgy1tuY=@proton.me>
On Sun, Jul 09, 2023 at 03:12:31PM +0000, Eric wrote:
> On Sunday, July 9th, 2023 at 01:02, George Shuklin <george.shuklin@gmail.com> wrote:
> > I got a rather interesting task: I need to check if a given set of rules
> > on the disk is the same as loaded into the kernel.
> >
> > The main problem is that nft list is quite different from the original
> > config (ordering, comments, etc), so I wonder if there is a way to make
> > nft just to read rules, process them and output back in the same format
> > as it is from nft ruleset list. Is there a way to force nft to just
> > 'process' rules to stdout without loading them into the kernel?
>
> Well, after experimenting a bit, I'm not going to say, "No, it can't be done" as I've got sort of a hack that might be usable.
>
> $ nft list ruleset | nft -c -d netlink -f - > x
> $ nft -c -d netlink -f my_rules.nft > y
> $ diff x y
>
> At the very least, the counter values are different (so sed them?), but maybe it might be made to sort of work???
`-s' can be used to remove the stateful part of the counters.
prev parent reply other threads:[~2023-07-10 7:39 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-09 8:02 Processing nftable rules without loading them into the kernel George Shuklin
2023-07-09 15:12 ` Eric
2023-07-10 7:39 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZKu1mF2S4dxhH3vj@calendula \
--to=pablo@netfilter.org \
--cc=evil.function@proton.me \
--cc=george.shuklin@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox