I have not found a similar issue/request
Summary:
It is a common feature in *nix daemons that a SIGHUP message sent to a service will cause the service to reload all configurations with zero (or near-zero) downtime. Currently the only option we have is to restart the service completely - but this means that the "protections" available from the service are temporarily unavailable.
Reason for noticing:
I've been crafting rules and finding that they didn't quite work or aren't loaded properly unless I restart the daemon completely. This is partly my own fault for having bad rules - but also it does highlight how fragile the service can be.
Other consequences
This also highlights an issue with existing long-lived connections to hostname destinations, where the link between the IP and the "allowed hostname" is forgotten. When the service restarts, these destinations are only recognised as IP addresses instead of their full hostnames. So when Steam happens to connect to "api.steampowered.com" that was allowed ; but after the restart, the connection to that same host 23.52.28.42 no longer links to that allowed hostname and gets blocked. I'm not sure if I should file a separate feature request for that. It is already two feature requests in quick succession so far from me. :-)
I have not found a similar issue/request
Summary:
It is a common feature in *nix daemons that a SIGHUP message sent to a service will cause the service to reload all configurations with zero (or near-zero) downtime. Currently the only option we have is to restart the service completely - but this means that the "protections" available from the service are temporarily unavailable.
Reason for noticing:
I've been crafting rules and finding that they didn't quite work or aren't loaded properly unless I restart the daemon completely. This is partly my own fault for having bad rules - but also it does highlight how fragile the service can be.
Other consequences
This also highlights an issue with existing long-lived connections to hostname destinations, where the link between the IP and the "allowed hostname" is forgotten. When the service restarts, these destinations are only recognised as IP addresses instead of their full hostnames. So when Steam happens to connect to "api.steampowered.com" that was allowed ; but after the restart, the connection to that same host
23.52.28.42no longer links to that allowed hostname and gets blocked. I'm not sure if I should file a separate feature request for that. It is already two feature requests in quick succession so far from me. :-)