This patch allows you to temporarily disable an entire table. You can change the state of a dormant table via NFT_MSG_NEWTABLE messages. Using this operation you can wake up a table, so their chains are registered. This provides atomicity at chain level. Thus, the rule-set of one chain is applied at once, avoiding any possible intermediate state in every chain. Still, the chains that belongs to a table are registered consecutively. This also allows you to have inactive tables in the kernel.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -96,14 +96,25 @@ enum nft_hook_attributes { · 95 unmodified lines | ||
| 96 | 96 | }; |
| 97 | 97 | #define NFTA_HOOK_MAX (__NFTA_HOOK_MAX - 1) |
| 98 | 98 | |
| 99 | +/** | |
| 100 | + * enum nft_table_flags - nf_tables table flags | |
| 101 | + * | |
| 102 | + * @NFT_TABLE_F_DORMANT: this table is not active | |
| 103 | + */ | |
| 104 | +enum nft_table_flags { | |
| 105 | + NFT_TABLE_F_DORMANT = 0x1, | |
| 106 | +}; | |
| 107 | + | |
| 99 | 108 | /** |
| 100 | 109 | * enum nft_table_attributes - nf_tables table netlink attributes |
| 101 | 110 | * |
| 102 | 111 | * @NFTA_TABLE_NAME: name of the table (NLA_STRING) |
| 112 | + * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32) | |
| 103 | 113 | */ |
| 104 | 114 | enum nft_table_attributes { |
| 105 | 115 | NFTA_TABLE_UNSPEC, |
| 106 | 116 | NFTA_TABLE_NAME, |
| 117 | + NFTA_TABLE_FLAGS, | |
| 107 | 118 | __NFTA_TABLE_MAX |
| 108 | 119 | }; |
| 109 | 120 | #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1) |