* idempotent nft delete table? (or: why does "flush table" delete rules but keep chains?)
@ 2020-04-30 4:26 Trent W. Buck
2020-04-30 15:12 ` John Haxby
0 siblings, 1 reply; 2+ messages in thread
From: Trent W. Buck @ 2020-04-30 4:26 UTC (permalink / raw
To: netfilter
A typical ruleset looks like
flush ruleset
table filter { ... }
That works fine until I have several partial rulesets (e.g. the
sysadmin, libvirtd, and sshguard) that manage their own tables in
parallel, e.g.
foo.nft:
flush ruleset
table foo { ... }
bar.nft:
flush ruleset
table bar { ... }
If I reload either file, both tables are removed, and only one table is
readded.
The obvious thing to try is this:
flush table foo
table foo { ... }
However this doesn't flush the chains, only the rules.
So if you make an edit like this:
flush table foo
table x {
- chain y {
+ chain z {
type filter hook input priority filter; policy drop
tcp dport ssh accept
}
}
What you end up with is a ruleset that looks like this:
table x {
chain y {
type filter hook input priority filter; policy drop;
}
chain z {
type filter hook input priority filter; policy drop;
tcp dport ssh accept
}
}
...and your SSH stops working.
I also considered this, but it will error out if the table doesn't exist yet:
flush table foo
table foo { ... }
I suppose I could use add table (which is idempotent) and then delete
table (which isn't), so ending up with
table foo
flush table foo
table foo { ... }
Is this sensible? Have I missed something obvious?
PS: I think the way normal people handle this is with a middleware layer
like firewalld (Fedora) or ufw (Ubuntu), but those are a bit too
heavyweight for my taste.
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: idempotent nft delete table? (or: why does "flush table" delete rules but keep chains?)
2020-04-30 4:26 idempotent nft delete table? (or: why does "flush table" delete rules but keep chains?) Trent W. Buck
@ 2020-04-30 15:12 ` John Haxby
0 siblings, 0 replies; 2+ messages in thread
From: John Haxby @ 2020-04-30 15:12 UTC (permalink / raw
To: trentbuck; +Cc: netfilter
> On 30 Apr 2020, at 05:26, trentbuck@gmail.com wrote:
>
> A typical ruleset looks like
>
> flush ruleset
> table filter { ... }
>
> That works fine until I have several partial rulesets (e.g. the
> sysadmin, libvirtd, and sshguard) that manage their own tables in
> parallel, e.g.
>
For various reasons, I construct a ruleset file and the first line or so comes from
nft list tables | sed -n '/mytablename/s/^/delete /p'
Which leads me to wonder whether there is any meaningful difference between flush and delete unless you don't want to delete sets defined in the table[1].
jch
[1] https://wiki.nftables.org/wiki-nftables/index.php/Configuring_tables
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-04-30 15:12 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-04-30 4:26 idempotent nft delete table? (or: why does "flush table" delete rules but keep chains?) Trent W. Buck
2020-04-30 15:12 ` John Haxby
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.