From patchwork Tue Feb 18 09:27:22 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 321330 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 2C0232C00BB for ; Tue, 18 Feb 2014 20:31:22 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754603AbaBRJbS (ORCPT ); Tue, 18 Feb 2014 04:31:18 -0500 Received: from Chamillionaire.breakpoint.cc ([80.244.247.6]:52421 "EHLO Chamillionaire.breakpoint.cc" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754521AbaBRJbR (ORCPT ); Tue, 18 Feb 2014 04:31:17 -0500 Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.80) (envelope-from ) id 1WFh1H-0005NG-FP; Tue, 18 Feb 2014 10:31:15 +0100 From: Florian Westphal To: netfilter-devel@vger.kernel.org Cc: Florian Westphal Subject: [PATCH 1/3 -next] netfilter: nft_ct: labels get support Date: Tue, 18 Feb 2014 10:27:22 +0100 Message-Id: <1392715644-4458-1-git-send-email-fw@strlen.de> X-Mailer: git-send-email 1.8.1.5 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Takes advantage of the fact that the number of labels is currently restricted to 2**128, ie. the extension area will always fit into nft register. Patrick says the kernel registers need to be changed anyway to deal with concatentations so we will probably not run into issues when the number of labels increases in a future kernel release. Signed-off-by: Florian Westphal --- include/uapi/linux/netfilter/nf_tables.h | 1 + net/netfilter/nft_ct.c | 22 ++++++++++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h index 83c985a..c84c452 100644 --- a/include/uapi/linux/netfilter/nf_tables.h +++ b/include/uapi/linux/netfilter/nf_tables.h @@ -601,6 +601,7 @@ enum nft_ct_keys { NFT_CT_PROTOCOL, NFT_CT_PROTO_SRC, NFT_CT_PROTO_DST, + NFT_CT_LABELS, }; /** diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index 917052e..cb0ffd2 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -19,6 +19,7 @@ #include #include #include +#include struct nft_ct { enum nft_ct_keys key:8; @@ -97,6 +98,24 @@ static void nft_ct_get_eval(const struct nft_expr *expr, goto err; strncpy((char *)dest->data, helper->name, sizeof(dest->data)); return; +#ifdef CONFIG_NF_CONNTRACK_LABELS + case NFT_CT_LABELS: { + struct nf_conn_labels *labels = nf_ct_labels_find(ct); + unsigned int size; + + if (!labels) + goto err; + size = labels->words * sizeof(long); + if (size > sizeof(dest->data)) + goto err; + memcpy(dest->data, labels->bits, size); + + if (size < sizeof(dest->data)) + memset(((char *) dest->data) + size, 0, + sizeof(dest->data) - size); + return; + } +#endif } tuple = &ct->tuplehash[priv->dir].tuple; @@ -221,6 +240,9 @@ static int nft_ct_init_validate_get(const struct nft_expr *expr, #ifdef CONFIG_NF_CONNTRACK_SECMARK case NFT_CT_SECMARK: #endif +#ifdef CONFIG_NF_CONNTRACK_LABELS + case NFT_CT_LABELS: +#endif case NFT_CT_EXPIRATION: case NFT_CT_HELPER: if (tb[NFTA_CT_DIRECTION] != NULL)