From 60084c30d0f03869a558c2de33a95ede8c0b3aa9 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 28 Oct 2020 20:55:30 +0100 Subject: conntrack: add flush filter command The NFCT_Q_FLUSH command flushes both IPv4 and IPv6 conntrack tables. Add new command NFCT_Q_FLUSH_FILTER that allows to flush based on the family to retain backward compatibility on NFCT_Q_FLUSH. Signed-off-by: Pablo Neira Ayuso --- include/libnetfilter_conntrack/libnetfilter_conntrack.h | 1 + src/conntrack/api.c | 3 +++ 2 files changed, 4 insertions(+) diff --git a/include/libnetfilter_conntrack/libnetfilter_conntrack.h b/include/libnetfilter_conntrack/libnetfilter_conntrack.h index c5c6b61..f02d827 100644 --- a/include/libnetfilter_conntrack/libnetfilter_conntrack.h +++ b/include/libnetfilter_conntrack/libnetfilter_conntrack.h @@ -452,6 +452,7 @@ enum nf_conntrack_query { NFCT_Q_CREATE_UPDATE, NFCT_Q_DUMP_FILTER, NFCT_Q_DUMP_FILTER_RESET, + NFCT_Q_FLUSH_FILTER, }; extern int nfct_query(struct nfct_handle *h, diff --git a/src/conntrack/api.c b/src/conntrack/api.c index 78d7d61..b7f64fb 100644 --- a/src/conntrack/api.c +++ b/src/conntrack/api.c @@ -831,6 +831,9 @@ __build_query_ct(struct nfnl_subsys_handle *ssh, nfct_fill_hdr(req, IPCTNL_MSG_CT_DELETE, NLM_F_ACK, *family, NFNETLINK_V0); break; + case NFCT_Q_FLUSH_FILTER: + nfct_fill_hdr(req, IPCTNL_MSG_CT_DELETE, NLM_F_ACK, *family, 1); + break; case NFCT_Q_DUMP: nfct_fill_hdr(req, IPCTNL_MSG_CT_GET, NLM_F_DUMP, *family, NFNETLINK_V0); -- cgit v1.2.3