Commit cf9dc09d authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso

netfilter: nf_tables: fix missing rules flushing per table

This patch allows you to atomically remove all rules stored in
a table via the NFT_MSG_DELRULE command. You only need to indicate
the specific table and no chain to flush all rules stored in that
table.
Signed-off-by: 's avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b4ef4ce0
...@@ -1717,6 +1717,19 @@ nf_tables_delrule_one(struct nft_ctx *ctx, struct nft_rule *rule) ...@@ -1717,6 +1717,19 @@ nf_tables_delrule_one(struct nft_ctx *ctx, struct nft_rule *rule)
return -ENOENT; return -ENOENT;
} }
static int nf_table_delrule_by_chain(struct nft_ctx *ctx)
{
struct nft_rule *rule;
int err;
list_for_each_entry(rule, &ctx->chain->rules, list) {
err = nf_tables_delrule_one(ctx, rule);
if (err < 0)
return err;
}
return 0;
}
static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb, static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
const struct nlmsghdr *nlh, const struct nlmsghdr *nlh,
const struct nlattr * const nla[]) const struct nlattr * const nla[])
...@@ -1725,8 +1738,8 @@ static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb, ...@@ -1725,8 +1738,8 @@ static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
const struct nft_af_info *afi; const struct nft_af_info *afi;
struct net *net = sock_net(skb->sk); struct net *net = sock_net(skb->sk);
const struct nft_table *table; const struct nft_table *table;
struct nft_chain *chain; struct nft_chain *chain = NULL;
struct nft_rule *rule, *tmp; struct nft_rule *rule;
int family = nfmsg->nfgen_family, err = 0; int family = nfmsg->nfgen_family, err = 0;
struct nft_ctx ctx; struct nft_ctx ctx;
...@@ -1738,22 +1751,29 @@ static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb, ...@@ -1738,22 +1751,29 @@ static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
if (IS_ERR(table)) if (IS_ERR(table))
return PTR_ERR(table); return PTR_ERR(table);
chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]); if (nla[NFTA_RULE_CHAIN]) {
if (IS_ERR(chain)) chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
return PTR_ERR(chain); if (IS_ERR(chain))
return PTR_ERR(chain);
}
nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla); nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
if (nla[NFTA_RULE_HANDLE]) { if (chain) {
rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]); if (nla[NFTA_RULE_HANDLE]) {
if (IS_ERR(rule)) rule = nf_tables_rule_lookup(chain,
return PTR_ERR(rule); nla[NFTA_RULE_HANDLE]);
if (IS_ERR(rule))
return PTR_ERR(rule);
err = nf_tables_delrule_one(&ctx, rule);
} else {
/* Remove all rules in this chain */
list_for_each_entry_safe(rule, tmp, &chain->rules, list) {
err = nf_tables_delrule_one(&ctx, rule); err = nf_tables_delrule_one(&ctx, rule);
} else {
err = nf_table_delrule_by_chain(&ctx);
}
} else {
list_for_each_entry(chain, &table->chains, list) {
ctx.chain = chain;
err = nf_table_delrule_by_chain(&ctx);
if (err < 0) if (err < 0)
break; break;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment