From ac3a68fb768b7f0e20493038139faa4704dc1846 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 12 Mar 2015 15:15:14 +0100 Subject: src: expose table flags The nf_tables kernel API provides a way to disable a table using the dormant flag. This patch adds the missing code to expose this feature through nft. Basically, if you want to disable a table and all its chains from seen any traffic, you have to type: nft add table filter { flags dormant\; } to re-enable the table, you have to: nft add table filter this clears the flags. Signed-off-by: Pablo Neira Ayuso --- include/netlink.h | 2 +- include/rule.h | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/include/netlink.h b/include/netlink.h index 4f794707..c1ff9c60 100644 --- a/include/netlink.h +++ b/include/netlink.h @@ -108,7 +108,7 @@ extern int netlink_delete_table(struct netlink_ctx *ctx, const struct handle *h, extern int netlink_list_tables(struct netlink_ctx *ctx, const struct handle *h, const struct location *loc); extern int netlink_get_table(struct netlink_ctx *ctx, const struct handle *h, - const struct location *loc); + const struct location *loc, struct table *table); extern int netlink_list_table(struct netlink_ctx *ctx, const struct handle *h, const struct location *loc); extern int netlink_flush_table(struct netlink_ctx *ctx, const struct handle *h, diff --git a/include/rule.h b/include/rule.h index 491411eb..90836bc4 100644 --- a/include/rule.h +++ b/include/rule.h @@ -63,6 +63,10 @@ extern void symbol_bind(struct scope *scope, const char *identifier, extern struct symbol *symbol_lookup(const struct scope *scope, const char *identifier); +enum table_flags { + TABLE_F_DORMANT = (1 << 0), +}; + /** * struct table - nftables table * @@ -71,6 +75,7 @@ extern struct symbol *symbol_lookup(const struct scope *scope, * @location: location the table was defined at * @chains: chains contained in the table * @sets: sets contained in the table + * @flags: table flags */ struct table { struct list_head list; @@ -79,6 +84,7 @@ struct table { struct scope scope; struct list_head chains; struct list_head sets; + enum table_flags flags; }; extern struct table *table_alloc(void); -- cgit v1.2.3