Update a chain without interrupting filtering

If you want to change the rules of a chain without leaving your traffic unfiltered, use bfcli chain update: the new chain will atomically replace the existing one.

Print the existing chain

$ sudo bfcli chain get --name block_sources
chain block_sources BF_HOOK_TC_INGRESS{ifindex=2} ACCEPT
    counters policy 4 packets 292 bytes; error 0 packets 0 bytes
    set blocklist (ip4.saddr) in {
        192.0.2.1
        192.0.2.2
    }
    rule
        (ip4.saddr) in blocklist
        counters 3 packets 294 bytes
        DROP

Take note of its name and its hook: the new chain must use the same ones, or chain update will reject it.

Write the new chain

Edit the file defining the chain, block_sources.bf here. For example, to block one more address on our TC ingress chain:

chain block_sources BF_HOOK_TC_INGRESS{ifindex=2} ACCEPT
    set blocklist (ip4.saddr) in { 192.0.2.1; 192.0.2.2; 192.0.2.3 }
    rule
        (ip4.saddr) in blocklist
        counter
        DROP

You can keep the hook options in the file: chain update will ignore them (bfcli prints a warning), and keep the chain attached where it is. If you want to modify the hook options, use bfcli chain set instead, but the replacement won’t be atomic.

The sets of the new chain will contain the elements defined in the file, and nothing else: if you changed them with chain update-set, update the file first.

Validate and update

$ bfcli chain update --from-file block_sources.bf --dry-run
warning: Hook options are ignored when updating a chain
info   : --dry-run used, chain not updated
$ sudo bfcli chain update --from-file block_sources.bf
warning: Hook options are ignored when updating a chain
$ sudo bfcli chain get --name block_sources
chain block_sources BF_HOOK_TC_INGRESS{ifindex=2} ACCEPT
    counters policy 0 packets 0 bytes; error 0 packets 0 bytes
    set blocklist (ip4.saddr) in {
        192.0.2.1
        192.0.2.2
        192.0.2.3
    }
    rule
        (ip4.saddr) in blocklist
        counters 0 packets 0 bytes
        DROP

The chain should be printed with its new rules, and the same hook options as before. Send some matching traffic if you want to be sure it filters what you expect.

Updating a chain resets its counters. If you only want to add or remove elements from a named set, see Update a blocklist: the counters are preserved, and you don’t have to write the whole chain again.

See Loading, attaching, and updating chains to understand what happens when a chain is replaced, and bfcli commands and global options for the options of chain update.