diff options
| author |   Florian Westphal <fw@strlen.de> | 2016-04-12 18:14:23 +0200 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2016-04-18 20:39:41 +0200 |
| commit | b4ef159927150bf1d63f36330bbb5239516ceb69 (patch) | |
| tree | 0b30997d4cc46842177684cd913e7aa5bdd2f3d6 /net/netfilter/xt_connlabel.c | |
| parent | netfilter: ctnetlink: remove unnecessary inlining (diff) | |
| download | linux-dev-b4ef159927150bf1d63f36330bbb5239516ceb69.tar.xz linux-dev-b4ef159927150bf1d63f36330bbb5239516ceb69.zip | |
netfilter: connlabels: move helpers to xt_connlabel
Currently labels can only be set either by iptables connlabel
match or via ctnetlink.
Before adding nftables set support, clean up the clabel core and move
helpers that nft will not need after all to the xtables module.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/xt_connlabel.c')
| -rw-r--r-- | net/netfilter/xt_connlabel.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/net/netfilter/xt_connlabel.c b/net/netfilter/xt_connlabel.c index bb9cbeb18868..d9b3e535d13a 100644 --- a/net/netfilter/xt_connlabel.c +++ b/net/netfilter/xt_connlabel.c @@ -18,6 +18,16 @@ MODULE_DESCRIPTION("Xtables: add/match connection trackling labels"); MODULE_ALIAS("ipt_connlabel"); MODULE_ALIAS("ip6t_connlabel"); +static bool connlabel_match(const struct nf_conn *ct, u16 bit) +{ + struct nf_conn_labels *labels = nf_ct_labels_find(ct); + + if (!labels) + return false; + + return BIT_WORD(bit) < labels->words && test_bit(bit, labels->bits); +} + static bool connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par) { @@ -33,7 +43,7 @@ connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par) if (info->options & XT_CONNLABEL_OP_SET) return (nf_connlabel_set(ct, info->bit) == 0) ^ invert; - return nf_connlabel_match(ct, info->bit) ^ invert; + return connlabel_match(ct, info->bit) ^ invert; } static int connlabel_mt_check(const struct xt_mtchk_param *par) |