func (ipsec *IPSec) Flush(destroy bool) error {
	ipsec.Lock()
	defer ipsec.Unlock()

	policies, err := netlink.XfrmPolicyList(syscall.AF_INET)
	if err != nil {
		return errors.Wrap(err, "xfrm policy list")
	}
	for _, p := range policies {
		if p.Mark != nil && p.Mark.Value == mark && len(p.Tmpls) != 0 {
			spi := SPI(p.Tmpls[0].Spi)
			if err := netlink.XfrmPolicyDel(&p); err != nil {
				return errors.Wrap(err, fmt.Sprintf("xfrm policy del (%s, %s, 0x%x)", p.Src, p.Dst, spi))
			}
		}
	}

	states, err := netlink.XfrmStateList(syscall.AF_INET)
	if err != nil {
		return errors.Wrap(err, "xfrm state list")
	}
	for _, s := range states {
		if _, ok := ipsec.spis[SPI(s.Spi)]; ok {
			if err := netlink.XfrmStateDel(&s); err != nil {
				return errors.Wrap(err, fmt.Sprintf("xfrm state list (%s, %s, 0x%x)", s.Src, s.Dst, s.Spi))
			}
		}
	}

	if err := ipsec.resetIPTables(destroy); err != nil {
		return errors.Wrap(err, "reset ip tables")
	}

	return nil
}
// Flush removes all policies/SAs established by us. Also, it removes chains and
// rules of iptables.
//
// If destroy is true, the chains and the rules won't be re-created.
Flush removes all policies/SAs established by us. Also, it removes chains and
rules of iptables.

If destroy is true, the chains and the rules won't be re-created.
// Flush removes all policies / SAs established by us . Also it removes chains and // rules of iptables . // // If destroy is true the chains and the rules won ' t be re - created .
func (ipsec *IPSec) Flush(destroy bool) error {
	ipsec.Lock()
	defer ipsec.Unlock()
	policies, err := netlink.XfrmPolicyList(syscall.AF_INET)
	if err != nil {
		return errors.Wrap(err, "xfrm policy list")
	}
	for _, p := range policies {
		if p.Mark != nil && p.Mark.Value == mark && len(p.Tmpls) != 0 {
			spi := SPI(p.Tmpls[0].Spi)
			if err := netlink.XfrmPolicyDel(&p); err != nil {
				return errors.Wrap(err, fmt.Sprintf("xfrm policy del (%s, %s, 0x%x)", p.Src, p.Dst, spi))
			}
		}
	}
	states, err := netlink.XfrmStateList(syscall.AF_INET)
	if err != nil {
		return errors.Wrap(err, "xfrm state list")
	}
	for _, s := range states {
		if _, ok := ipsec.spis[SPI(s.Spi)]; ok {
			if err := netlink.XfrmStateDel(&s); err != nil {
				return errors.Wrap(err, fmt.Sprintf("xfrm state list (%s, %s, 0x%x)", s.Src, s.Dst, s.Spi))
			}
		}
	}
	if err := ipsec.resetIPTables(destroy); err != nil {
		return errors.Wrap(err, "reset ip tables")
	}
	return nil
}
func ( ipsec * IPSec ) Flush ( destroy bool ) error { ipsec . Lock ( ) defer ipsec . Unlock ( ) policies , err := netlink . XfrmPolicyList ( syscall . AF_INET ) if err != nil { return errors . Wrap ( err , " " ) } for _ , p := range policies { if p . Mark != nil && p . Mark . Value == mark && len ( p . Tmpls ) != 0 { spi := SPI ( p . Tmpls [ 0 ] . Spi ) if err := netlink . XfrmPolicyDel ( & p ) ; err != nil { return errors . Wrap ( err , fmt . Sprintf ( " " , p . Src , p . Dst , spi ) ) } } } states , err := netlink . XfrmStateList ( syscall . AF_INET ) if err != nil { return errors . Wrap ( err , " " ) } for _ , s := range states { if _ , ok := ipsec . spis [ SPI ( s . Spi ) ] ; ok { if err := netlink . XfrmStateDel ( & s ) ; err != nil { return errors . Wrap ( err , fmt . Sprintf ( " " , s . Src , s . Dst , s . Spi ) ) } } } if err := ipsec . resetIPTables ( destroy ) ; err != nil { return errors . Wrap ( err , " " ) } return nil }
Flush removes all policies/SAs established by us.
Flush removes all policies / SAs established by us .