From 6def2fbb5deb33b489dfef1ed8d23aac9f639c9f Mon Sep 17 00:00:00 2001 From: Arturo Borrero Date: Tue, 2 Sep 2014 16:42:22 +0200 Subject: src: add `flush ruleset' This patch adds the `flush ruleset' operation to nft. The syntax is: % nft flush ruleset [family] To flush all the ruleset (all families): % nft flush ruleset To flush the ruleset of a given family: % nft flush ruleset ip % nft flush ruleset inet This flush is a shortcut operation which deletes all rules, sets, tables and chains. It's possible since the modifications in the kernel to the NFT_MSG_DELTABLE API call. Users can benefit of this operation when doing an atomic replacement of the entire ruleset, loading a file like this: ========= flush ruleset table ip filter { chain input { counter accept } } ========= Also, users who want to simply clean the ruleset for whatever reason can do it now without having to iterate families/tables. Signed-off-by: Arturo Borrero Gonzalez Signed-off-by: Pablo Neira Ayuso --- src/netlink.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'src/netlink.c') diff --git a/src/netlink.c b/src/netlink.c index 102f799a..7d3e71ff 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -1444,6 +1444,28 @@ int netlink_batch_send(struct list_head *err_list) return mnl_batch_talk(nf_sock, err_list); } +int netlink_flush_ruleset(struct netlink_ctx *ctx, const struct handle *h, + const struct location *loc) +{ + int err; + struct nft_table *nlt; + + if (!ctx->batch_supported) { + netlink_io_error(ctx, loc, "Operation not supported."); + return -1; + } + + nlt = alloc_nft_table(h); + err = mnl_nft_table_batch_del(nf_sock, nlt, 0, ctx->seqnum); + nft_table_free(nlt); + + if (err < 0) + netlink_io_error(ctx, loc, "Could not flush the ruleset: %s", + strerror(errno)); + + return err; +} + struct nft_ruleset *netlink_dump_ruleset(struct netlink_ctx *ctx, const struct handle *h, const struct location *loc) -- cgit v1.2.3