On Wed, 28 Oct 2026 02:24:40 +0900 dev@haytok.jp wrote:
Hi Stefano,
Thanks for the detailed explanation, and for the background on the original design!
We're not sure whether a rollback after 2. would work: forwarding rules that might have worked earlier might not work now (for example because host addresses changed).
However, in a general case, I guess that the existing (old) rules are still more likely to work than not. That is, given:
a. new forwarding rules don't work because of an unintended configuration error
b. old forwarding rules wouldn't work anymore if re-applied because of a setup change
I think a. is much more likely, so a rollback would be beneficial and give the user the chance to look at possible configuration errors without switching to a possibly unintended state. What do you think?
I strongly agree.
In practice, a. is far more likely. Case b. can happen depending on what changed on the host, but that's beyond what pasta can handle, so all we can do is report it and let the user fix the setup.
1. abort on any failure of fwd_listen_init() (maintaining the current behaviour of fwd_listen_sync_()), and:
2. close any listening sockets (first part of fwd_listen_switch()) that we might have just opened
3. swap the rules again (as you can see, we already preserve the old rules, because we planned to complete the rollback implementation at some point)
4. call fwd_listen_init() on the old rules
I agree, and that's what my work-in-progress patch does.
5. make sure we report failure to the client
Here's how I'm thinking of implementing this. Please let me know if I got something wrong:
- make fwd_listen_switch() return an int, distinguishing the case where we rolled back to the old rules from the case where the rollback failed too
It needs to be able to return failure, for sure. We don't _strictly_ need to distinguish the two types of failures, because if the rollback fails, there's nothing we can do, and we can ignore that failure. On the other hand, it might be nice to report it to the user via pesto, so yes, it would probably be nice to distinguish the types of failure. By the way of fwd_listen_switch(), it could simply be called a second time to implement a rollback (the old rules are preserved in c->fwd_pending), but the error messages wouldn't match anymore. I see a few possible solutions for that: error messages could be moved the caller (perhaps my favourite option at the moment), or we could pass an 'bool rollback' argument, or move most of the logic to a separate function and introduce an intermediate caller... I'm not sure. I guess it would be better to try things out and see how they look like.
- in conf_handler(), write that result to the control socket right after fwd_listen_switch(), before conf_close()
- in pesto, read it after send_conf(), and if the update failed, print that the old rules were restored and exit non-zero
Both steps make sense to me.
For the content, I'd start with a status only (success / rolled back / restore failed). fwd_sync_one() already logs which rule failed on the pasta side, so returning that to pesto could be added later if needed.
Right, yes, given that we distribute client and server together, we don't have to really plan much in advance or be particularly future-proof. We can just bump versions as needed. The day somebody else starts developing other clients (for example to embed in container engines or virtual machine managers), then we'll have to think again about this, but it's not the case for the moment.
Since this adds a message from the server, we need to bump PESTO_PROTOCOL_VERSION to 3, and have pesto skip reading the result if the server version is below 3. Is that OK?
Definitely, yes, that's how versioning was meant to be used.
I'm planning to send 5. as a separate patch from the rollback (1. to 4.).
Right, probably easier to review.
...this looks reasonable to me and better than the existing behaviour, but it's pointless to do this if we want to finish things up and add the rollback for this case.
Agreed, I'll drop this patch.
I was already planning to implement the rollback feature, and I have a work-in-progress patch covering steps 1. to 4. you listed. I'll send it once it's ready.
That sounds like a plan. Thanks for working on this! -- Stefano