[Bug 1696] "nft -s list ruleset" should include "flush ruleset" as first line

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1696

--- Comment #7 from Phil Sutter <phil at nwl.cc> ---
(In reply to Apachez from comment #6)
> (In reply to Phil Sutter from comment #5)
> > (In reply to Apachez from comment #2)
> > > Because when taking a backup I would expect it to be able to restore without
> > > having to reboot the full box, and also be able to restore without throwing
> > > out all sort of hard to troubleshoot errors such as:
> > > 
> > > # BUG: invalid input descriptor type 1634164560
> > > # nft: erec.c:161: erec_print: Assertion `0' failed.
> > 
> > That's a bug, but you will see "funny" things like duplicate rules.
> > Basically,
> > doing 'nft list ruleset | nft -f -' is doing a non-flushing restore. Ignoring
> > this detail while implementing or simulating a system service is a problem
> > software shouldn't solve IMHO.
> 
> Hence why a "save" and "restore" option should exist in the nft binary.

We could ship an nft-save shell script:

| #!/bin/sh
| 
| echo "flush ruleset"
| exec nft "$@" list ruleset

What would a "restore option" do from your perspective?

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20230731/edd94595/attachment.html>