diff options
author | Phil Sutter <phil@nwl.cc> | 2019-08-28 12:33:55 +0200 |
---|---|---|
committer | Phil Sutter <phil@nwl.cc> | 2019-10-17 19:03:00 +0200 |
commit | c41b98babd55f35834e5fea599a914d69d60a9bd (patch) | |
tree | 9ae60a41765df0d07b7863e98ef121ea5bef0ded /extensions/libip6t_REJECT.man | |
parent | 48a21d5c7af074bd502a4f6fa7d8a46cfa719732 (diff) |
nft: Optimize flushing all chains of a table
Leverage nftables' support for flushing all chains of a table by
omitting NFTNL_RULE_CHAIN attribute in NFT_MSG_DELRULE payload.
The only caveat is with verbose output, as that still requires to have a
list of (existing) chains to iterate over. Apart from that, implementing
this shortcut is pretty straightforward: Don't retrieve a chain list and
just call __nft_rule_flush() directly which doesn't set above attribute
if chain name pointer is NULL.
A bigger deal is keeping rule cache consistent: Instead of just clearing
rule list for each flushed chain, flush_rule_cache() is updated to
iterate over all cached chains of the given table, clearing their rule
lists if not called for a specific chain.
While being at it, sort local variable declarations in nft_rule_flush()
from longest to shortest and drop the loop-local 'chain_name' variable
(but instead use 'chain' function parameter which is not used at that
point).
Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/libip6t_REJECT.man')
0 files changed, 0 insertions, 0 deletions