Patchwork [nftables,2/2] netlink: improve rule deletion per chain

login
register
mail settings
Submitter Pablo Neira
Date Nov. 24, 2013, 11:08 p.m.
Message ID <1385334496-3544-1-git-send-email-pablo@netfilter.org>
Download mbox | patch
Permalink /patch/293777/
State Accepted
Headers show

Comments

Pablo Neira - Nov. 24, 2013, 11:08 p.m.
With this patch, nft asks the kernel for deleting all rules in a chain.
This replaces the current behaviour that requires to dump all the rules,
then iterate over that list to delete one by one, which is prone to races
and slowier.

After this patch, the following two commands are equivalent:

 nft flush chain filter input
 nft delete rule filter input

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/netlink.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Patch

diff --git a/src/netlink.c b/src/netlink.c
index 15cba79..533634a 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -645,7 +645,7 @@  int netlink_list_chain(struct netlink_ctx *ctx, const struct handle *h,
 int netlink_flush_chain(struct netlink_ctx *ctx, const struct handle *h,
 			const struct location *loc)
 {
-	return netlink_flush_rules(ctx, h, loc);
+	return netlink_del_rule_batch(ctx, h, loc);
 }
 
 int netlink_add_table(struct netlink_ctx *ctx, const struct handle *h,