diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2012-11-19 15:32:18 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-12-30 23:50:21 +0100 |
| commit | 5705ea1f4e3c9cd3d5d9cbcf84b9733ce1f07e57 (patch) | |
| tree | 8bf9943f0eee5b64acbc1e49ee5ce5c59f56d87b /iptables/nft.c | |
| parent | 890fd9ef76ad0c11695fb0d09a88169e6e46584f (diff) | |
xtables-restore: add support for dormant tables
This patch adds support for dormant tables for xtables-restore.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables/nft.c')
| -rw-r--r-- | iptables/nft.c | 55 |
1 files changed, 52 insertions, 3 deletions
diff --git a/iptables/nft.c b/iptables/nft.c index 24301200..1f5ecb70 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -229,7 +229,9 @@ static struct builtin_table { }, }; -static int nft_table_builtin_add(struct nft_handle *h, struct builtin_table *_t) +static int +nft_table_builtin_add(struct nft_handle *h, struct builtin_table *_t, + bool dormant) { char buf[MNL_SOCKET_BUFFER_SIZE]; struct nlmsghdr *nlh; @@ -241,6 +243,10 @@ static int nft_table_builtin_add(struct nft_handle *h, struct builtin_table *_t) return -1; nft_table_attr_set(t, NFT_TABLE_ATTR_NAME, (char *)_t->name); + if (dormant) { + nft_table_attr_set_u32(t, NFT_TABLE_ATTR_FLAGS, + NFT_TABLE_F_DORMANT); + } nlh = nft_table_nlmsg_build_hdr(buf, NFT_MSG_NEWTABLE, AF_INET, NLM_F_ACK|NLM_F_EXCL, h->seq); @@ -367,7 +373,7 @@ nft_chain_builtin_init(struct nft_handle *h, const char *table, ret = -1; goto out; } - if (nft_table_builtin_add(h, t) < 0) { + if (nft_table_builtin_add(h, t, false) < 0) { /* Built-in table already initialized, skip. */ if (errno == EEXIST) goto out; @@ -423,6 +429,49 @@ int nft_chain_add(struct nft_handle *h, const struct nft_chain *c) return mnl_talk(h, nlh, NULL, NULL); } +int nft_table_set_dormant(struct nft_handle *h, const char *table) +{ + int ret = 0, i; + struct builtin_table *t; + + t = nft_table_builtin_find(table); + if (t == NULL) { + ret = -1; + goto out; + } + /* Add this table as dormant */ + if (nft_table_builtin_add(h, t, true) < 0) { + /* Built-in table already initialized, skip. */ + if (errno == EEXIST) + goto out; + } + for (i=0; t->chains[i].name != NULL && i<NF_INET_NUMHOOKS; i++) + __nft_chain_builtin_init(h, t, t->chains[i].name, NF_ACCEPT); +out: + return ret; +} + +int nft_table_wake_dormant(struct nft_handle *h, const char *table) +{ + char buf[MNL_SOCKET_BUFFER_SIZE]; + struct nlmsghdr *nlh; + struct nft_table *t; + + t = nft_table_alloc(); + if (t == NULL) + return -1; + + nft_table_attr_set(t, NFT_TABLE_ATTR_NAME, (char *)table); + nft_table_attr_set_u32(t, NFT_TABLE_ATTR_FLAGS, 0); + + nlh = nft_table_nlmsg_build_hdr(buf, NFT_MSG_NEWTABLE, AF_INET, + NLM_F_ACK, h->seq); + nft_table_nlmsg_build_payload(nlh, t); + nft_table_free(t); + + return mnl_talk(h, nlh, NULL, NULL); +} + static void nft_chain_print_debug(struct nft_chain *c, struct nlmsghdr *nlh) { #ifdef NLDEBUG @@ -449,7 +498,7 @@ __nft_chain_set(struct nft_handle *h, const char *table, _t = nft_table_builtin_find(table); /* if this built-in table does not exists, create it */ if (_t != NULL) - nft_table_builtin_add(h, _t); + nft_table_builtin_add(h, _t, false); _c = nft_chain_builtin_find(_t, chain); if (_c != NULL) { |