[PATCH] [RFC] nf_tables: dormant tables

[pablo@netfilter.org]

From: Pablo Neira Ayuso <pablo@netfilter.org>

Hi,

The following patch adds the concept of dormant tables. Basically,
it's a flag that you can set to get a table (and all they chains)
inactive. Dormant tables have no effect and see no traffic.

This operation can be also used to support atomic replacement
at chain level, that can be done following these steps:

1) set table as dormant
2) flush the rule-set in all their chains
3) add the new rule-set
4) set table as active

The main target of this patch is to provide a way to load the
rule-set in a chain at once, avoiding possible some inconsistent
state at the chain level.

Coments welcome.

Pablo Neira Ayuso (1):
  netfilter: nf_tables: add support for dormant tables

 include/linux/netfilter/nf_tables.h |   10 ++++
 include/net/netfilter/nf_tables.h   |    2 +
 net/netfilter/nf_tables_api.c       |   90 +++++++++++++++++++++++++++++++++--
 3 files changed, 98 insertions(+), 4 deletions(-)

-- 
1.7.10.4