mnl: add mnl_nft_setelem_batch_flush() and use it from netlink_flush_setelems()

Commit 8bd99f2fca7e ("mnl: don't send empty set elements netlink message
to kernel") broke set flush because we still need to send the netlink
message with no elements to flush sets.

To avoid more whack-a-mole games, add a new explicit function
mnl_nft_setelem_batch_flush() that is used to request a set flush,
instead of reusing the one that allows us to explicitly delete given set
elements.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/mnl.h b/include/mnl.h
index f74dfee5c8c6f3c8e969d2db2870b84ab6572980..87db96afd369687073749f4cda07b3650f1dafcc 100644 (file)
--- a/include/mnl.h
+++ b/include/mnl.h
@@ -82,6 +82,8 @@ int mnl_nft_setelem_delete(struct mnl_socket *nf_sock, struct nftnl_set *nls,
                           unsigned int flags);
 int mnl_nft_setelem_batch_del(struct nftnl_set *nls,
                              unsigned int flags, uint32_t seq);
+int mnl_nft_setelem_batch_flush(struct nftnl_set *nls, unsigned int flags,
+                               uint32_t seqnum);
 int mnl_nft_setelem_get(struct mnl_socket *nf_sock, struct nftnl_set *nls);
 
 struct nftnl_ruleset *mnl_nft_ruleset_dump(struct mnl_socket *nf_sock,

diff --git a/src/mnl.c b/src/mnl.c
index d107015c2743f5e860648d861837278f4f1eeba7..257b630e2a2696858309b5693a646ad89c588260 100644 (file)
--- a/src/mnl.c
+++ b/src/mnl.c
@@ -902,6 +902,21 @@ int mnl_nft_setelem_batch_add(struct nftnl_set *nls, unsigned int flags,
        return mnl_nft_setelem_batch(nls, NFT_MSG_NEWSETELEM, flags, seqnum);
 }
 
+int mnl_nft_setelem_batch_flush(struct nftnl_set *nls, unsigned int flags,
+                               uint32_t seqnum)
+{
+       struct nlmsghdr *nlh;
+
+       nlh = nftnl_set_elem_nlmsg_build_hdr(nftnl_batch_buffer(batch),
+                       NFT_MSG_DELSETELEM,
+                       nftnl_set_get_u32(nls, NFTNL_SET_FAMILY),
+                       NLM_F_CREATE | flags, seqnum);
+       nftnl_set_elems_nlmsg_build_payload(nlh, nls);
+       mnl_nft_batch_continue();
+
+       return 0;
+}
+
 int mnl_nft_setelem_batch_del(struct nftnl_set *nls, unsigned int flags,
                              uint32_t seqnum)
 {

diff --git a/src/netlink.c b/src/netlink.c
index 714df4e892b249c6b64cc7877c76cc16b0f58d44..d6d00199d746d36f256bde8f75290550e36d1736 100644 (file)
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -1410,7 +1410,19 @@ static int netlink_del_setelems_compat(struct netlink_ctx *ctx,
 int netlink_flush_setelems(struct netlink_ctx *ctx, const struct handle *h,
                           const struct location *loc)
 {
-       return netlink_del_setelems_batch(ctx, h, NULL);
+       struct nftnl_set *nls;
+       int err;
+
+       nls = alloc_nftnl_set(h);
+       netlink_dump_set(nls);
+
+       err = mnl_nft_setelem_batch_flush(nls, 0, ctx->seqnum);
+       nftnl_set_free(nls);
+       if (err < 0)
+               netlink_io_error(ctx, loc,
+                                "Could not flush set elements: %s",
+                                strerror(errno));
+       return err;
 }
 
 static struct expr *netlink_parse_concat_elem(const struct datatype *dtype,