summaryrefslogtreecommitdiffstats
path: root/src/scanner.l
diff options
context:
space:
mode:
authorArturo Borrero <arturo.borrero.glez@gmail.com>2014-09-02 16:42:22 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2014-09-09 15:38:14 +0200
commit6def2fbb5deb33b489dfef1ed8d23aac9f639c9f (patch)
treedb82c71e17f7e828555f5ac50134774388e4b357 /src/scanner.l
parent9173c1ab4846f5934932511c97b29b7755ca1e19 (diff)
src: add `flush ruleset'
This patch adds the `flush ruleset' operation to nft. The syntax is: % nft flush ruleset [family] To flush all the ruleset (all families): % nft flush ruleset To flush the ruleset of a given family: % nft flush ruleset ip % nft flush ruleset inet This flush is a shortcut operation which deletes all rules, sets, tables and chains. It's possible since the modifications in the kernel to the NFT_MSG_DELTABLE API call. Users can benefit of this operation when doing an atomic replacement of the entire ruleset, loading a file like this: ========= flush ruleset table ip filter { chain input { counter accept } } ========= Also, users who want to simply clean the ruleset for whatever reason can do it now without having to iterate families/tables. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/scanner.l')
-rw-r--r--src/scanner.l1
1 files changed, 1 insertions, 0 deletions
diff --git a/src/scanner.l b/src/scanner.l
index 929dbf6e..601ea3c1 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -240,6 +240,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr})
"element" { return ELEMENT; }
"map" { return MAP; }
"handle" { return HANDLE; }
+"ruleset" { return RULESET; }
"accept" { return ACCEPT; }
"drop" { return DROP; }