diff options
author | Arturo Borrero <arturo.borrero.glez@gmail.com> | 2014-09-02 16:42:22 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-09-09 15:38:14 +0200 |
commit | 6def2fbb5deb33b489dfef1ed8d23aac9f639c9f (patch) | |
tree | db82c71e17f7e828555f5ac50134774388e4b357 /src/netlink.c | |
parent | 9173c1ab4846f5934932511c97b29b7755ca1e19 (diff) |
src: add `flush ruleset'
This patch adds the `flush ruleset' operation to nft.
The syntax is:
% nft flush ruleset [family]
To flush all the ruleset (all families):
% nft flush ruleset
To flush the ruleset of a given family:
% nft flush ruleset ip
% nft flush ruleset inet
This flush is a shortcut operation which deletes all rules, sets, tables
and chains.
It's possible since the modifications in the kernel to the NFT_MSG_DELTABLE
API call.
Users can benefit of this operation when doing an atomic replacement of the
entire ruleset, loading a file like this:
=========
flush ruleset
table ip filter {
chain input {
counter accept
}
}
=========
Also, users who want to simply clean the ruleset for whatever reason can do it now
without having to iterate families/tables.
Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/netlink.c')
-rw-r--r-- | src/netlink.c | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/src/netlink.c b/src/netlink.c index 102f799a..7d3e71ff 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -1444,6 +1444,28 @@ int netlink_batch_send(struct list_head *err_list) return mnl_batch_talk(nf_sock, err_list); } +int netlink_flush_ruleset(struct netlink_ctx *ctx, const struct handle *h, + const struct location *loc) +{ + int err; + struct nft_table *nlt; + + if (!ctx->batch_supported) { + netlink_io_error(ctx, loc, "Operation not supported."); + return -1; + } + + nlt = alloc_nft_table(h); + err = mnl_nft_table_batch_del(nf_sock, nlt, 0, ctx->seqnum); + nft_table_free(nlt); + + if (err < 0) + netlink_io_error(ctx, loc, "Could not flush the ruleset: %s", + strerror(errno)); + + return err; +} + struct nft_ruleset *netlink_dump_ruleset(struct netlink_ctx *ctx, const struct handle *h, const struct location *loc) |