@@ -144,10 +144,11 @@ the MARK value into the ctmark.
Otherwise, the mask is logically ANDed with the existing mark before the comparision.
In "--create" mode, the mask is ignored.
.TP
-.BI "-l, --label " "LABEL,..."
-Specify the conntrack labels.
+.BI "-l, --label " "LABEL"
+Specify a conntrack label.
This option is only available in conjunction with "-L, --dump" or "-E, --event".
-Match entries whose labels matches at least those specified as arguments.
+Match entries whose labels match at least those specified.
+Use multiple -l commands to specify multiple labels that need to be set.
.TP
.BI "-c, --secmark " "SECMARK"
Specify the conntrack selinux security mark.
@@ -1828,6 +1828,31 @@ static void labelmap_init(void)
perror("nfct_labelmap_new");
}
+static void merge_bitmasks(struct nfct_bitmask **current,
+ struct nfct_bitmask *src)
+{
+ unsigned int i;
+
+ if (*current == NULL) {
+ *current = src;
+ return;
+ }
+
+ /* "current" must be the larger bitmask object */
+ if (nfct_bitmask_maxbit(src) > nfct_bitmask_maxbit(*current)) {
+ struct nfct_bitmask *tmp = *current;
+ *current = src;
+ src = tmp;
+ }
+
+ for (i = 0; i <= nfct_bitmask_maxbit(src); i++) {
+ if (nfct_bitmask_test_bit(src, i))
+ nfct_bitmask_set_bit(*current, i);
+ }
+
+ nfct_bitmask_destroy(src);
+}
+
int main(int argc, char *argv[])
{
int c, cmd;
@@ -2030,7 +2055,9 @@ int main(int argc, char *argv[])
struct nfct_bitmask * b = nfct_bitmask_new(max);
parse_label(b, optarg2);
- tmpl.label = b;
+
+ /* join "-l foo -l bar" into single bitmask object */
+ merge_bitmasks(&tmpl.label, b);
free(optarg2);
break;
case 'a':
Using -l foo -l bar caused the "foo" label to be lost. Merge multiple -l options so "-l foo,bar" and "-l foo -l bar" have same effect. Signed-off-by: Florian Westphal <fw@strlen.de> --- Change since v1: retain old -l "foo,bar" syntax make of "-l foo -l bar,baz" work conntrack.8 | 7 ++++--- src/conntrack.c | 29 ++++++++++++++++++++++++++++- 2 files changed, 32 insertions(+), 4 deletions(-)