diff options
author | Arturo Borrero <arturo.borrero.glez@gmail.com> | 2014-09-02 16:42:22 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-09-09 15:38:14 +0200 |
commit | 6def2fbb5deb33b489dfef1ed8d23aac9f639c9f (patch) | |
tree | db82c71e17f7e828555f5ac50134774388e4b357 /src/parser.y | |
parent | 9173c1ab4846f5934932511c97b29b7755ca1e19 (diff) |
src: add `flush ruleset'
This patch adds the `flush ruleset' operation to nft.
The syntax is:
% nft flush ruleset [family]
To flush all the ruleset (all families):
% nft flush ruleset
To flush the ruleset of a given family:
% nft flush ruleset ip
% nft flush ruleset inet
This flush is a shortcut operation which deletes all rules, sets, tables
and chains.
It's possible since the modifications in the kernel to the NFT_MSG_DELTABLE
API call.
Users can benefit of this operation when doing an atomic replacement of the
entire ruleset, loading a file like this:
=========
flush ruleset
table ip filter {
chain input {
counter accept
}
}
=========
Also, users who want to simply clean the ruleset for whatever reason can do it now
without having to iterate families/tables.
Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/parser.y')
-rw-r--r-- | src/parser.y | 30 |
1 files changed, 25 insertions, 5 deletions
diff --git a/src/parser.y b/src/parser.y index a4ccf732..aa40f905 100644 --- a/src/parser.y +++ b/src/parser.y @@ -187,6 +187,7 @@ static int monitor_lookup_event(const char *event) %token ELEMENT "element" %token MAP "map" %token HANDLE "handle" +%token RULESET "ruleset" %token INET "inet" @@ -397,11 +398,11 @@ static int monitor_lookup_event(const char *event) %type <cmd> base_cmd add_cmd create_cmd insert_cmd delete_cmd list_cmd flush_cmd rename_cmd export_cmd monitor_cmd %destructor { cmd_free($$); } base_cmd add_cmd create_cmd insert_cmd delete_cmd list_cmd flush_cmd rename_cmd export_cmd monitor_cmd -%type <handle> table_spec tables_spec chain_spec chain_identifier ruleid_spec -%destructor { handle_free(&$$); } table_spec tables_spec chain_spec chain_identifier ruleid_spec +%type <handle> table_spec tables_spec chain_spec chain_identifier ruleid_spec ruleset_spec +%destructor { handle_free(&$$); } table_spec tables_spec chain_spec chain_identifier ruleid_spec ruleset_spec %type <handle> set_spec set_identifier %destructor { handle_free(&$$); } set_spec set_identifier -%type <val> handle_spec family_spec position_spec +%type <val> handle_spec family_spec family_spec_explicit position_spec %type <table> table_block_alloc table_block %destructor { close_scope(state); table_free($$); } table_block_alloc @@ -775,6 +776,10 @@ flush_cmd : TABLE table_spec { $$ = cmd_alloc(CMD_FLUSH, CMD_OBJ_SET, &$2, &@$, NULL); } + | RULESET ruleset_spec + { + $$ = cmd_alloc(CMD_FLUSH, CMD_OBJ_RULESET, &$2, &@$, NULL); + } ; rename_cmd : CHAIN chain_spec identifier @@ -1164,8 +1169,11 @@ string : STRING | QUOTED_STRING ; -family_spec : /* empty */ { $$ = NFPROTO_IPV4; } - | IP { $$ = NFPROTO_IPV4; } +family_spec : /* empty */ { $$ = NFPROTO_IPV4; } + | family_spec_explicit + ; + +family_spec_explicit : IP { $$ = NFPROTO_IPV4; } | IP6 { $$ = NFPROTO_IPV6; } | INET { $$ = NFPROTO_INET; } | ARP { $$ = NFPROTO_ARP; } @@ -1254,6 +1262,18 @@ comment_spec : /* empty */ } ; +ruleset_spec : /* empty */ + { + memset(&$$, 0, sizeof($$)); + $$.family = NFPROTO_UNSPEC; + } + | family_spec_explicit + { + memset(&$$, 0, sizeof($$)); + $$.family = $1; + } + ; + rule : stmt_list comment_spec { struct stmt *i; |