1 files changed, 41 insertions, 8 deletions

diff --git a/src/netlink.c b/src/netlink.c
index fe979e3..189f55a 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -26,7 +26,7 @@
 #include <errno.h>
 #include <sys/types.h>
 #include <sys/socket.h>
-#include <sys/fcntl.h>
+#include <fcntl.h>
 #include <libnetfilter_conntrack/libnetfilter_conntrack_tcp.h>
 
 struct nfct_handle *nl_init_event_handler(void)
@@ -146,19 +146,53 @@ void nl_resize_socket_buffer(struct nfct_handle *h)
 			 "to %u bytes", CONFIG(netlink_buffer_size));
 }
 
+static const int family = AF_UNSPEC;
+
 int nl_dump_conntrack_table(struct nfct_handle *h)
 {
-	return nfct_query(h, NFCT_Q_DUMP, &CONFIG(family));
+	return nfct_query(h, NFCT_Q_DUMP, &family);
 }
 
-int nl_flush_conntrack_table(struct nfct_handle *h)
+static int
+nl_flush_selective_cb(enum nf_conntrack_msg_type type,
+		      struct nf_conntrack *ct, void *data)
 {
-	return nfct_query(h, NFCT_Q_FLUSH, &CONFIG(family));
+	/* don't delete this conntrack, it's in the ignore filter */
+	if (ct_filter_conntrack(ct, 1))
+		return NFCT_CB_CONTINUE;
+
+	switch(type) {
+	case NFCT_T_UPDATE:
+		nl_destroy_conntrack(STATE(flush), ct);
+		break;
+	default:
+		STATE(stats).nl_dump_unknown_type++;
+		break;
+	}
+	return NFCT_CB_CONTINUE;
+}
+
+int nl_flush_conntrack_table_selective(void)
+{
+	struct nfct_handle *h;
+	int ret;
+
+	h = nfct_open(CONNTRACK, 0);
+	if (h == NULL) {
+		dlog(LOG_ERR, "cannot open handle");
+		return -1;
+	}
+	nfct_callback_register(h, NFCT_T_ALL, nl_flush_selective_cb, NULL);
+
+	ret = nfct_query(h, NFCT_Q_DUMP, &family);
+
+	nfct_close(h);
+
+	return ret;
 }
 
 int nl_send_resync(struct nfct_handle *h)
 {
-	int family = CONFIG(family);
 	return nfct_send(h, NFCT_Q_DUMP, &family);
 }
 
@@ -347,16 +381,15 @@ int nl_get_expect(struct nfct_handle *h, const struct nf_expect *exp)
 
 int nl_dump_expect_table(struct nfct_handle *h)
 {
-	return nfexp_query(h, NFCT_Q_DUMP, &CONFIG(family));
+	return nfexp_query(h, NFCT_Q_DUMP, &family);
 }
 
 int nl_flush_expect_table(struct nfct_handle *h)
 {
-	return nfexp_query(h, NFCT_Q_FLUSH, &CONFIG(family));
+	return nfexp_query(h, NFCT_Q_FLUSH, &family);
 }
 
 int nl_send_expect_resync(struct nfct_handle *h)
 {
-	int family = CONFIG(family);
 	return nfexp_send(h, NFCT_Q_DUMP, &family);
 }