Not logged in
Log in now
Create an account
Subscribe to LWN
LWN.net Weekly Edition for May 16, 2013
A look at the PyPy 2.0 release
PostgreSQL 9.3 beta: Federated databases and more
LWN.net Weekly Edition for May 9, 2013
(Nearly) full tickless operation in 3.10
I'm pretty sure iptables-restore does atomic updates of an entire table. It doesn't let you synchronize across multiple tables (nat, filter, mangle), but I'd hardly call it "leaving things open".
LCE: Challenges for Linux networking
Posted Nov 8, 2012 9:18 UTC (Thu) by rusty (✭ supporter ✭, #26)
That doesn't mean that applications use the kernel API appropriately; for a long time libiptc didn't give you a great way to do atomic updates of more than one rule at a time.
Changing NAT rules is a weird one, because for radical changes you really want to kill all old connections. Figuring out which existing connections would be NATed differently and resetting them might be a nice twist if people were seeing problems here.
Posted Nov 8, 2012 12:48 UTC (Thu) by jengelh (subscriber, #33263)
I do not think you can actually solve this "twist". The fact that NFCT mappings - and thus TCP tuples - do not change when the nat table is changed could be considered a feature in itself. Sort of like an RCU for tuples.
Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds