From 27f09380ebb0fc21c4cd20070b828a27430b5de1 Mon Sep 17 00:00:00 2001 From: Felix Huettner Date: Tue, 5 Dec 2023 09:35:16 +0000 Subject: conntrack: support flush filtering flushing already supports filtering on the kernel side for value like mark, l3num or zone. This patch extends the userspace code to also support this. To reduce code duplication the `nfct_filter_dump` struct and associated logic is reused. Note that filtering by tuple is not supported, since `CTA_FILTER` is not yet supported on the kernel side for flushing. Trying to use it returns ENOTSUP. Signed-off-by: Felix Huettner Signed-off-by: Pablo Neira Ayuso --- src/conntrack/filter_dump.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'src/conntrack/filter_dump.c') diff --git a/src/conntrack/filter_dump.c b/src/conntrack/filter_dump.c index 0a19985..fd2d002 100644 --- a/src/conntrack/filter_dump.c +++ b/src/conntrack/filter_dump.c @@ -64,3 +64,13 @@ int __build_filter_dump(struct nfnlhdr *req, size_t size, { return nfct_nlmsg_build_filter(&req->nlh, filter_dump); } + +int __build_filter_flush(struct nfnlhdr *req, size_t size, + const struct nfct_filter_dump *filter_dump) +{ + if (filter_dump->set & (1 << NFCT_FILTER_DUMP_TUPLE)) { + errno = ENOTSUP; + return -1; + } + return nfct_nlmsg_build_filter(&req->nlh, filter_dump); +} -- cgit v1.2.3