This patch allows you to temporarily disable an entire table. You can change the state of a dormant table via NFT_MSG_NEWTABLE messages. Using this operation you can wake up a table, so their chains are registered. This provides atomicity at chain level. Thus, the rule-set of one chain is applied at once, avoiding any possible intermediate state in every chain. Still, the chains that belongs to a table are registered consecutively. This also allows you to have inactive tables in the kernel.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -96,14 +96,25 @@ enum nft_hook_attributes { · 95 unmodified lines | |||
| 96 | }; | 96 | }; |
| 97 | #define NFTA_HOOK_MAX (__NFTA_HOOK_MAX - 1) | 97 | #define NFTA_HOOK_MAX (__NFTA_HOOK_MAX - 1) |
| 98 | 98 | ||
| 99 | /** | ||
| 100 | * enum nft_table_flags - nf_tables table flags | ||
| 101 | * | ||
| 102 | * @NFT_TABLE_F_DORMANT: this table is not active | ||
| 103 | */ | ||
| 104 | enum nft_table_flags { | ||
| 105 | NFT_TABLE_F_DORMANT = 0x1, | ||
| 106 | }; | ||
| 107 | |||
| 99 | /** | 108 | /** |
| 100 | * enum nft_table_attributes - nf_tables table netlink attributes | 109 | * enum nft_table_attributes - nf_tables table netlink attributes |
| 101 | * | 110 | * |
| 102 | * @NFTA_TABLE_NAME: name of the table (NLA_STRING) | 111 | * @NFTA_TABLE_NAME: name of the table (NLA_STRING) |
| 112 | * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32) | ||
| 103 | */ | 113 | */ |
| 104 | enum nft_table_attributes { | 114 | enum nft_table_attributes { |
| 105 | NFTA_TABLE_UNSPEC, | 115 | NFTA_TABLE_UNSPEC, |
| 106 | NFTA_TABLE_NAME, | 116 | NFTA_TABLE_NAME, |
| 117 | NFTA_TABLE_FLAGS, | ||
| 107 | __NFTA_TABLE_MAX | 118 | __NFTA_TABLE_MAX |
| 108 | }; | 119 | }; |
| 109 | #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) | 120 | #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) |