summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2016-12-05 22:45:22 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2016-12-05 22:50:46 +0100
commit23b760a774cf12dd18fb68a84d502662ae6eebd8 (patch)
tree243a95e6647ab44bcf1815e15ff229823257aaa9 /src
parent1d398465831066c5e98fb2a58d7aa0547595de33 (diff)
src: add support to flush sets
You can use this new command to remove all existing elements in a set: # nft flush set filter xyz After this command, the set 'xyz' in table 'filter' becomes empty. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
-rw-r--r--src/evaluate.c3
-rw-r--r--src/netlink.c9
-rw-r--r--src/rule.c3
3 files changed, 14 insertions, 1 deletions
diff --git a/src/evaluate.c b/src/evaluate.c
index e11a455a..8a3da54e 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2857,9 +2857,11 @@ static int cmd_evaluate_list(struct eval_ctx *ctx, struct cmd *cmd)
static int cmd_evaluate_flush(struct eval_ctx *ctx, struct cmd *cmd)
{
int ret;
+
ret = cache_update(cmd->op, ctx->msgs);
if (ret < 0)
return ret;
+
switch (cmd->obj) {
case CMD_OBJ_RULESET:
cache_flush();
@@ -2870,6 +2872,7 @@ static int cmd_evaluate_flush(struct eval_ctx *ctx, struct cmd *cmd)
*/
case CMD_OBJ_CHAIN:
/* Chains don't hold sets */
+ case CMD_OBJ_SET:
break;
default:
BUG("invalid command object type %u\n", cmd->obj);
diff --git a/src/netlink.c b/src/netlink.c
index f8e600ff..714df4e8 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -1374,7 +1374,8 @@ static int netlink_del_setelems_batch(struct netlink_ctx *ctx,
int err;
nls = alloc_nftnl_set(h);
- alloc_setelem_cache(expr, nls);
+ if (expr)
+ alloc_setelem_cache(expr, nls);
netlink_dump_set(nls);
err = mnl_nft_setelem_batch_del(nls, 0, ctx->seqnum);
@@ -1406,6 +1407,12 @@ static int netlink_del_setelems_compat(struct netlink_ctx *ctx,
return err;
}
+int netlink_flush_setelems(struct netlink_ctx *ctx, const struct handle *h,
+ const struct location *loc)
+{
+ return netlink_del_setelems_batch(ctx, h, NULL);
+}
+
static struct expr *netlink_parse_concat_elem(const struct datatype *dtype,
struct expr *data)
{
diff --git a/src/rule.c b/src/rule.c
index 8710767b..f1bb6cfe 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -1244,6 +1244,9 @@ static int do_command_flush(struct netlink_ctx *ctx, struct cmd *cmd)
return netlink_flush_table(ctx, &cmd->handle, &cmd->location);
case CMD_OBJ_CHAIN:
return netlink_flush_chain(ctx, &cmd->handle, &cmd->location);
+ case CMD_OBJ_SET:
+ return netlink_flush_setelems(ctx, &cmd->handle,
+ &cmd->location);
case CMD_OBJ_RULESET:
return netlink_flush_ruleset(ctx, &cmd->handle, &cmd->location);
default: