From 6def2fbb5deb33b489dfef1ed8d23aac9f639c9f Mon Sep 17 00:00:00 2001 From: Arturo Borrero Date: Tue, 2 Sep 2014 16:42:22 +0200 Subject: src: add `flush ruleset' This patch adds the `flush ruleset' operation to nft. The syntax is: % nft flush ruleset [family] To flush all the ruleset (all families): % nft flush ruleset To flush the ruleset of a given family: % nft flush ruleset ip % nft flush ruleset inet This flush is a shortcut operation which deletes all rules, sets, tables and chains. It's possible since the modifications in the kernel to the NFT_MSG_DELTABLE API call. Users can benefit of this operation when doing an atomic replacement of the entire ruleset, loading a file like this: ========= flush ruleset table ip filter { chain input { counter accept } } ========= Also, users who want to simply clean the ruleset for whatever reason can do it now without having to iterate families/tables. Signed-off-by: Arturo Borrero Gonzalez Signed-off-by: Pablo Neira Ayuso --- src/scanner.l | 1 + 1 file changed, 1 insertion(+) (limited to 'src/scanner.l') diff --git a/src/scanner.l b/src/scanner.l index 929dbf6e..601ea3c1 100644 --- a/src/scanner.l +++ b/src/scanner.l @@ -240,6 +240,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "element" { return ELEMENT; } "map" { return MAP; } "handle" { return HANDLE; } +"ruleset" { return RULESET; } "accept" { return ACCEPT; } "drop" { return DROP; } -- cgit v1.2.3