kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

netfilter: connlabels: move set helper to xt_connlabel

Browse source 
xt_connlabel is the only user so move it.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2016-07-21 12:51:17 +02:00 committed by Pablo Neira Ayuso
parent 23014011ba
commit 857ed310c0
3 changed files with 16 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
include/net/netfilter/nf_conntrack_labels.h
View file

@ -37,8 +37,6 @@ static inline struct nf_conn_labels *nf_ct_labels_ext_add(struct nf_conn *ct)
#endif #endif
} }
int nf_connlabel_set(struct nf_conn *ct, u16 bit);
int nf_connlabels_replace(struct nf_conn *ct, int nf_connlabels_replace(struct nf_conn *ct,
const u32 *data, const u32 *mask, unsigned int words); const u32 *data, const u32 *mask, unsigned int words);

17
net/netfilter/nf_conntrack_labels.c
View file

@ -16,23 +16,6 @@
static spinlock_t nf_connlabels_lock; static spinlock_t nf_connlabels_lock;
int nf_connlabel_set(struct nf_conn *ct, u16 bit)
{
struct nf_conn_labels *labels = nf_ct_labels_find(ct);
if (!labels)
return -ENOSPC;
if (test_bit(bit, labels->bits))
return 0;
if (!test_and_set_bit(bit, labels->bits))
nf_conntrack_event_cache(IPCT_LABEL, ct);
return 0;
}
EXPORT_SYMBOL_GPL(nf_connlabel_set);
static int replace_u32(u32 *address, u32 mask, u32 new) static int replace_u32(u32 *address, u32 mask, u32 new)
{ {
u32 old, tmp; u32 old, tmp;

29
net/netfilter/xt_connlabel.c
View file

@ -9,6 +9,7 @@
#include <linux/module.h> #include <linux/module.h>
#include <linux/skbuff.h> #include <linux/skbuff.h>
#include <net/netfilter/nf_conntrack.h> #include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_ecache.h>
#include <net/netfilter/nf_conntrack_labels.h> #include <net/netfilter/nf_conntrack_labels.h>
#include <linux/netfilter/x_tables.h> #include <linux/netfilter/x_tables.h>
@ -18,21 +19,12 @@ MODULE_DESCRIPTION("Xtables: add/match connection trackling labels");
MODULE_ALIAS("ipt_connlabel"); MODULE_ALIAS("ipt_connlabel");
MODULE_ALIAS("ip6t_connlabel"); MODULE_ALIAS("ip6t_connlabel");
static bool connlabel_match(const struct nf_conn *ct, u16 bit)
{
struct nf_conn_labels *labels = nf_ct_labels_find(ct);
if (!labels)
return false;
return test_bit(bit, labels->bits);
}
static bool static bool
connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par) connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
{ {
const struct xt_connlabel_mtinfo *info = par->matchinfo; const struct xt_connlabel_mtinfo *info = par->matchinfo;
enum ip_conntrack_info ctinfo; enum ip_conntrack_info ctinfo;
struct nf_conn_labels *labels;
struct nf_conn *ct; struct nf_conn *ct;
bool invert = info->options & XT_CONNLABEL_OP_INVERT; bool invert = info->options & XT_CONNLABEL_OP_INVERT;
@ -40,10 +32,21 @@ connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
if (ct == NULL || nf_ct_is_untracked(ct)) if (ct == NULL || nf_ct_is_untracked(ct))
return invert; return invert;
if (info->options & XT_CONNLABEL_OP_SET) labels = nf_ct_labels_find(ct);
return (nf_connlabel_set(ct, info->bit) == 0) ^ invert; if (!labels)
return invert;
return connlabel_match(ct, info->bit) ^ invert; if (test_bit(info->bit, labels->bits))
return !invert;
if (info->options & XT_CONNLABEL_OP_SET) {
if (!test_and_set_bit(info->bit, labels->bits))
nf_conntrack_event_cache(IPCT_LABEL, ct);
return !invert;
}
return invert;
} }
static int connlabel_mt_check(const struct xt_mtchk_param *par) static int connlabel_mt_check(const struct xt_mtchk_param *par)