[2/3] conntrack: favor multiple -l options over -l foo,bar

diff --git a/conntrack.8 b/conntrack.8
index f273434..6410e5b 100644
--- a/conntrack.8
+++ b/conntrack.8
@@ -144,10 +144,11 @@  the MARK value into the ctmark.
 Otherwise, the mask is logically ANDed with the existing mark before the comparision.
 In "--create" mode, the mask is ignored.
 .TP
-.BI "-l, --label " "LABEL,..."
-Specify the conntrack labels.
+.BI "-l, --label " "LABEL"
+Specify a conntrack label.
 This option is only available in conjunction with "-L, --dump" or "-E, --event".
-Match entries whose labels matches at least those specified as arguments.
+Match entries whose labels match at least those specified.
+Use multiple -l commands to specify multiple labels that need to be set.
 .TP
 .BI "-c, --secmark " "SECMARK"
 Specify the conntrack selinux security mark.
diff --git a/src/conntrack.c b/src/conntrack.c
index 2567c08..4548169 100644
--- a/src/conntrack.c
+++ b/src/conntrack.c
@@ -829,59 +829,6 @@  parse_u32_mask(const char *arg, struct u32_mask *m)
 		m->mask = ~0;
 }
 
-static int
-get_label(char *name)
-{
-	int bit = nfct_labelmap_get_bit(labelmap, name);
-	if (bit < 0)
-		exit_error(PARAMETER_PROBLEM, "unknown label '%s'", name);
-	return bit;
-}
-
-static void
-set_label(struct nfct_bitmask *b, char *name)
-{
-	int bit = get_label(name);
-	nfct_bitmask_set_bit(b, bit);
-}
-
-static unsigned int
-set_max_label(char *name, unsigned int current_max)
-{
-	int bit = get_label(name);
-	if ((unsigned int) bit > current_max)
-		return (unsigned int) bit;
-	return current_max;
-}
-
-static unsigned int
-parse_label_get_max(char *arg)
-{
-	unsigned int max = 0;
-	char *parse;
-
-	while ((parse = strchr(arg, ',')) != NULL) {
-		parse[0] = '\0';
-		max = set_max_label(arg, max);
-		arg = &parse[1];
-	}
-
-	max = set_max_label(arg, max);
-	return max;
-}
-
-static void
-parse_label(struct nfct_bitmask *b, char *arg)
-{
-	char * parse;
-	while ((parse = strchr(arg, ',')) != NULL) {
-		parse[0] = '\0';
-		set_label(b, arg);
-		arg = &parse[1];
-	}
-	set_label(b, arg);
-}
-
 static void
 add_command(unsigned int *cmd, const int newcmd)
 {
@@ -1827,6 +1774,49 @@  static void labelmap_init(void)
 		perror("nfct_labelmap_new");
 }
 
+static void merge_bitmasks(struct nfct_bitmask **current,
+			  struct nfct_bitmask *src)
+{
+	unsigned int i;
+
+	if (*current == NULL) {
+		*current = src;
+		return;
+	}
+
+	/* "current" must be the larger bitmask object */
+	if (nfct_bitmask_maxbit(src) > nfct_bitmask_maxbit(*current)) {
+		struct nfct_bitmask *tmp = *current;
+		*current = src;
+		src = tmp;
+	}
+
+	for (i = 0; i <= nfct_bitmask_maxbit(src); i++) {
+		if (nfct_bitmask_test_bit(src, i))
+			nfct_bitmask_set_bit(*current, i);
+		nfct_bitmask_destroy(src);
+		return;
+	}
+
+	nfct_bitmask_destroy(src);
+}
+
+static struct nfct_bitmask *name_to_bitmask(const char *name)
+{
+	int bit;
+	struct nfct_bitmask *b;
+
+	bit = nfct_labelmap_get_bit(labelmap, name);
+	if (bit < 0)
+		exit_error(PARAMETER_PROBLEM, "unknown label '%s'", name);
+
+	b = nfct_bitmask_new(bit);
+	if (!b)
+		exit_error(OTHER_PROBLEM, "out of memory");
+	nfct_bitmask_set_bit(b, bit);
+	return b;
+}
+
 int main(int argc, char *argv[])
 {
 	int c, cmd;
@@ -2021,16 +2011,14 @@  int main(int argc, char *argv[])
 			break;
 		case 'l':
 			options |= opt2type[c];
-			char *optarg2 = strdup(optarg);
 
 			labelmap_init();
 
-			unsigned int max = parse_label_get_max(optarg);
-			struct nfct_bitmask * b = nfct_bitmask_new(max);
+			struct nfct_bitmask *b;
+			b = name_to_bitmask(optarg);
+			/* join "-l foo -l bar" into single bitmask object */
+			merge_bitmasks(&tmpl.label, b);
 
-			parse_label(b, optarg2);
-			tmpl.label = b;
-			free(optarg2);
 			break;
 		case 'a':
 			fprintf(stderr, "WARNING: ignoring -%c, "