Commit b4ef1599 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netfilter: connlabels: move helpers to xt_connlabel

Currently labels can only be set either by iptables connlabel
match or via ctnetlink.

Before adding nftables set support, clean up the clabel core and move
helpers that nft will not need after all to the xtables module.
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 4054ff45
...@@ -45,7 +45,6 @@ static inline struct nf_conn_labels *nf_ct_labels_ext_add(struct nf_conn *ct) ...@@ -45,7 +45,6 @@ static inline struct nf_conn_labels *nf_ct_labels_ext_add(struct nf_conn *ct)
#endif #endif
} }
bool nf_connlabel_match(const struct nf_conn *ct, u16 bit);
int nf_connlabel_set(struct nf_conn *ct, u16 bit); int nf_connlabel_set(struct nf_conn *ct, u16 bit);
int nf_connlabels_replace(struct nf_conn *ct, int nf_connlabels_replace(struct nf_conn *ct,
......
...@@ -16,28 +16,11 @@ ...@@ -16,28 +16,11 @@
static spinlock_t nf_connlabels_lock; static spinlock_t nf_connlabels_lock;
static unsigned int label_bits(const struct nf_conn_labels *l)
{
unsigned int longs = l->words;
return longs * BITS_PER_LONG;
}
bool nf_connlabel_match(const struct nf_conn *ct, u16 bit)
{
struct nf_conn_labels *labels = nf_ct_labels_find(ct);
if (!labels)
return false;
return bit < label_bits(labels) && test_bit(bit, labels->bits);
}
EXPORT_SYMBOL_GPL(nf_connlabel_match);
int nf_connlabel_set(struct nf_conn *ct, u16 bit) int nf_connlabel_set(struct nf_conn *ct, u16 bit)
{ {
struct nf_conn_labels *labels = nf_ct_labels_find(ct); struct nf_conn_labels *labels = nf_ct_labels_find(ct);
if (!labels || bit >= label_bits(labels)) if (!labels || BIT_WORD(bit) >= labels->words)
return -ENOSPC; return -ENOSPC;
if (test_bit(bit, labels->bits)) if (test_bit(bit, labels->bits))
......
...@@ -18,6 +18,16 @@ MODULE_DESCRIPTION("Xtables: add/match connection trackling labels"); ...@@ -18,6 +18,16 @@ MODULE_DESCRIPTION("Xtables: add/match connection trackling labels");
MODULE_ALIAS("ipt_connlabel"); MODULE_ALIAS("ipt_connlabel");
MODULE_ALIAS("ip6t_connlabel"); MODULE_ALIAS("ip6t_connlabel");
static bool connlabel_match(const struct nf_conn *ct, u16 bit)
{
struct nf_conn_labels *labels = nf_ct_labels_find(ct);
if (!labels)
return false;
return BIT_WORD(bit) < labels->words && test_bit(bit, labels->bits);
}
static bool static bool
connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par) connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
{ {
...@@ -33,7 +43,7 @@ connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par) ...@@ -33,7 +43,7 @@ connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
if (info->options & XT_CONNLABEL_OP_SET) if (info->options & XT_CONNLABEL_OP_SET)
return (nf_connlabel_set(ct, info->bit) == 0) ^ invert; return (nf_connlabel_set(ct, info->bit) == 0) ^ invert;
return nf_connlabel_match(ct, info->bit) ^ invert; return connlabel_match(ct, info->bit) ^ invert;
} }
static int connlabel_mt_check(const struct xt_mtchk_param *par) static int connlabel_mt_check(const struct xt_mtchk_param *par)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment