Use libmnl and libnetfilter_conntrack mnl helpers to flush the conntrack
table entries.
Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@xxxxxxxxx>
---
src/conntrack.c | 28 +++++++++++++++++++++++-----
1 file changed, 23 insertions(+), 5 deletions(-)
diff --git a/src/conntrack.c b/src/conntrack.c
index 8cd760b..d20ccff 100644
--- a/src/conntrack.c
+++ b/src/conntrack.c
@@ -2417,6 +2417,20 @@ nfct_mnl_set_ct(struct nfct_mnl_socket *sock,
return nfct_mnl_talk(sock, nlh, NULL);
}
+static int
+nfct_mnl_set(struct nfct_mnl_socket *sock,
+ uint16_t subsys, uint16_t type, uint8_t family)
+{
+ char buf[MNL_SOCKET_BUFFER_SIZE];
+ struct nlmsghdr *nlh;
+
+ nlh = nfct_mnl_nlmsghdr_put(buf, subsys, type,
+ NLM_F_ACK,
+ family);
+
+ return nfct_mnl_talk(sock, nlh, NULL);
+}
+
static int
nfct_mnl_request(struct nfct_mnl_socket *sock,
uint16_t subsys, uint16_t type, const struct nf_conntrack *ct,
@@ -3522,11 +3536,15 @@ static int do_command_ct(const char *progname, struct ct_cmd *cmd)
break;
case CT_FLUSH:
- cth = nfct_open(CONNTRACK, 0);
- if (!cth)
- exit_error(OTHER_PROBLEM, "Can't open handler");
- res = nfct_query(cth, NFCT_Q_FLUSH_FILTER, &cmd->family);
- nfct_close(cth);
+ res = nfct_mnl_socket_open(sock, 0);
+ if (res < 0)
+ exit_error(OTHER_PROBLEM, "Can't open netlink socket");
+
+ res = nfct_mnl_set(sock,
+ NFNL_SUBSYS_CTNETLINK,
+ IPCTNL_MSG_CT_DELETE,
+ cmd->family);
+ nfct_mnl_socket_close(sock);
fprintf(stderr, "%s v%s (conntrack-tools): ",PROGNAME,VERSION);
fprintf(stderr,"connection tracking table has been emptied.\n");
break;
--
2.25.1
