netfilter: connlabels: move set helper to xt_connlabel

xt_connlabel is the only user so move it.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_conntrack_labels.h b/include/net/netfilter/nf_conntrack_labels.h
index 0fd4989de8360dc9f3c00855334dd30b03b1233b..498814626e28b7115345308694bb66d240933f9f 100644 (file)
--- a/include/net/netfilter/nf_conntrack_labels.h
+++ b/include/net/netfilter/nf_conntrack_labels.h
@@ -37,8 +37,6 @@ static inline struct nf_conn_labels *nf_ct_labels_ext_add(struct nf_conn *ct)
 #endif
 }
 
-int nf_connlabel_set(struct nf_conn *ct, u16 bit);
-
 int nf_connlabels_replace(struct nf_conn *ct,
                          const u32 *data, const u32 *mask, unsigned int words);
 

diff --git a/net/netfilter/nf_conntrack_labels.c b/net/netfilter/nf_conntrack_labels.c
index 7686200f9acee1aa68955867b7820d84def95830..bcab8bde73128f9f9f8b4dba31a1c283b07f8eb1 100644 (file)
--- a/net/netfilter/nf_conntrack_labels.c
+++ b/net/netfilter/nf_conntrack_labels.c
@@ -16,23 +16,6 @@
 
 static spinlock_t nf_connlabels_lock;
 
-int nf_connlabel_set(struct nf_conn *ct, u16 bit)
-{
-       struct nf_conn_labels *labels = nf_ct_labels_find(ct);
-
-       if (!labels)
-               return -ENOSPC;
-
-       if (test_bit(bit, labels->bits))
-               return 0;
-
-       if (!test_and_set_bit(bit, labels->bits))
-               nf_conntrack_event_cache(IPCT_LABEL, ct);
-
-       return 0;
-}
-EXPORT_SYMBOL_GPL(nf_connlabel_set);
-
 static int replace_u32(u32 *address, u32 mask, u32 new)
 {
        u32 old, tmp;

diff --git a/net/netfilter/xt_connlabel.c b/net/netfilter/xt_connlabel.c
index c9fba8ade3d52fd6c905854aff5f5b553afac815..03d66f1c5e69069077fa65b76339554d7c56ee6d 100644 (file)
--- a/net/netfilter/xt_connlabel.c
+++ b/net/netfilter/xt_connlabel.c
@@ -9,6 +9,7 @@
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_conntrack_labels.h>
 #include <linux/netfilter/x_tables.h>
 
@@ -18,21 +19,12 @@ MODULE_DESCRIPTION("Xtables: add/match connection trackling labels");
 MODULE_ALIAS("ipt_connlabel");
 MODULE_ALIAS("ip6t_connlabel");
 
-static bool connlabel_match(const struct nf_conn *ct, u16 bit)
-{
-       struct nf_conn_labels *labels = nf_ct_labels_find(ct);
-
-       if (!labels)
-               return false;
-
-       return test_bit(bit, labels->bits);
-}
-
 static bool
 connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
        const struct xt_connlabel_mtinfo *info = par->matchinfo;
        enum ip_conntrack_info ctinfo;
+       struct nf_conn_labels *labels;
        struct nf_conn *ct;
        bool invert = info->options & XT_CONNLABEL_OP_INVERT;
 
@@ -40,10 +32,21 @@ connlabel_mt(const struct sk_buff *skb, struct xt_action_param *par)
        if (ct == NULL || nf_ct_is_untracked(ct))
                return invert;
 
-       if (info->options & XT_CONNLABEL_OP_SET)
-               return (nf_connlabel_set(ct, info->bit) == 0) ^ invert;
+       labels = nf_ct_labels_find(ct);
+       if (!labels)
+               return invert;
+
+       if (test_bit(info->bit, labels->bits))
+               return !invert;
+
+       if (info->options & XT_CONNLABEL_OP_SET) {
+               if (!test_and_set_bit(info->bit, labels->bits))
+                       nf_conntrack_event_cache(IPCT_LABEL, ct);
+
+               return !invert;
+       }
 
-       return connlabel_match(ct, info->bit) ^ invert;
+       return invert;
 }
 
 static int connlabel_mt_check(const struct xt_mtchk_param *par)