@@ -20,28 +20,19 @@ import (

 // #include <nftables/libnftables.h>

 import "C"

-type nftHandle = *C.struct_nft_ctx

+type nftCtx C.struct_nft_ctx

-// nftApply calls libnftables to execute the nftables commands in nftCmd.

-// Acquire t.applyLock before calling this function.

-func (t *table) nftApply(ctx context.Context, nftCmd []byte) error {

+// Apply calls libnftables to execute the nftables commands in nftCmd.

+func (h *nftCtx) Apply(ctx context.Context, nftCmd []byte) error {

 	ctx, span := otel.Tracer("").Start(ctx, spanPrefix+".nftApply.cgo")

 	defer span.End()

-	if t.nftHandle == nil {

-		handle, err := newNftHandle()

-		if err != nil {

-			return err

-		}

-		t.nftHandle = handle

-	}

-

 	cCmd := C.CString(string(nftCmd))

 	defer C.free(unsafe.Pointer(cCmd))

-	ret := C.nft_run_cmd_from_buffer(t.nftHandle, cCmd)

-	stdout := C.GoString(C.nft_ctx_get_output_buffer(t.nftHandle))

-	stderr := C.GoString(C.nft_ctx_get_error_buffer(t.nftHandle))

+	ret := C.nft_run_cmd_from_buffer((*C.struct_nft_ctx)(h), cCmd)

+	stdout := C.GoString(C.nft_ctx_get_output_buffer((*C.struct_nft_ctx)(h)))

+	stderr := C.GoString(C.nft_ctx_get_error_buffer((*C.struct_nft_ctx)(h)))

 	if ret != 0 {

 		return fmt.Errorf("libnftables: failed to apply commands (code %d), stderr: %s", int(ret), stderr)

 	}

@@ -49,7 +40,7 @@ func (t *table) nftApply(ctx context.Context, nftCmd []byte) error {

 	return nil

 }

-func newNftHandle() (_ *C.struct_nft_ctx, retErr error) {

+func newNftCtx() (_ *nftCtx, retErr error) {

 	handle := C.nft_ctx_new(C.NFT_CTX_DEFAULT)

 	if handle == nil {

 		return nil, errors.New("libnftables: failed to create new nft handle")

@@ -65,14 +56,9 @@ func newNftHandle() (_ *C.struct_nft_ctx, retErr error) {

 	if ret := C.nft_ctx_buffer_error(handle); ret != 0 {

 		return nil, fmt.Errorf("libnftables: failed to set error buffer (code %d)", int(ret))

 	}

-	return handle, nil

+	return (*nftCtx)(handle), nil

 }

-func (t *table) closeNftHandle() {

-	t.applyLock.Lock()

-	defer t.applyLock.Unlock()

-	if t.nftHandle != nil {

-		C.nft_ctx_free(t.nftHandle)

-		t.nftHandle = nil

-	}

+func (h *nftCtx) Close() {

+	C.nft_ctx_free((*C.struct_nft_ctx)(h))

 }

@@ -15,13 +15,17 @@ import (

 	"go.opentelemetry.io/otel"

 )

-type nftHandle = struct{}

+type nftCtx struct{}

 var lookPathNSEnter = sync.OnceValues(func() (string, error) {

 	return exec.LookPath("nsenter")

 })

-func (t *table) nftApply(ctx context.Context, nftCmd []byte) error {

+func newNftCtx() (*nftCtx, error) {

+	return *nftCtx{}, nil

+}

+

+func (*nftCtx) Apply(ctx context.Context, nftCmd []byte) error {

 	ctx, span := otel.Tracer("").Start(ctx, spanPrefix+".nftApply.exec")

 	defer span.End()

@@ -82,5 +86,5 @@ func (t *table) nftApply(ctx context.Context, nftCmd []byte) error {

 	return nil

 }

-func (t *table) closeNftHandle() {

+func (*nftCtx) Close() {

 }

@@ -258,7 +258,20 @@ type table struct {

 	MustFlush      bool

 	applyLock sync.Mutex

-	nftHandle nftHandle // applyLock must be held to access

+	nftHandle *nftCtx // applyLock must be held to access

+}

+

+// nftApply executes the nftables commands in nftCmd.

+// Acquire t.applyLock before calling this function.

+func (t *table) nftApply(ctx context.Context, nftCmd []byte) error {

+	if t.nftHandle == nil {

+		h, err := newNftCtx()

+		if err != nil {

+			return err

+		}

+		t.nftHandle = h

+	}

+	return t.nftHandle.Apply(ctx, nftCmd)

 }

 // Table is a handle for an nftables table.

@@ -305,7 +318,12 @@ func NewTable(family Family, name string) (Table, error) {

 // the underlying nftables table.

 func (t Table) Close() error {

 	if t.IsValid() {

-		t.t.closeNftHandle()

+		t.t.applyLock.Lock()

+		defer t.t.applyLock.Unlock()

+		if t.t.nftHandle != nil {

+			t.t.nftHandle.Close()

+			t.t.nftHandle = nil

+		}

 		t.t = nil

 	}

 	return nil