Eric Lee / smarc-fsl-linux-kernel

19 Apr, 2016

2 commits

  • adff6c656   netfilter: connlabels: change nf_connlabels_get bit arg to 'highest used' ... Browse Code »

    nf_connlabel_set() takes the bit number that we would like to set.
    nf_connlabels_get() however took the number of bits that we want to
    support.

    So e.g. nf_connlabels_get(32) support bits 0 to 31, but not 32.
    This changes nf_connlabels_get() to take the highest bit that we want
    to set.

    Callers then don't have to cope with a potential integer wrap
    when using nf_connlabels_get(bit + 1) anymore.

    Current callers are fine, this change is only to make folloup
    nft ct label set support simpler.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     
  • b4ef15992   netfilter: connlabels: move helpers to xt_connlabel ... Browse Code »

    Currently labels can only be set either by iptables connlabel
    match or via ctnetlink.

    Before adding nftables set support, clean up the clabel core and move
    helpers that nft will not need after all to the xtables module.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal
     

28 Aug, 2015

1 commit

  • 86ca02e77   netfilter: connlabels: Export setting connlabel length ... Browse Code »

    Add functions to change connlabel length into nf_conntrack_labels.c so
    they may be reused by other modules like OVS and nftables without
    needing to jump through xt_match_check() hoops.

    Suggested-by: Florian Westphal
    Signed-off-by: Joe Stringer
    Acked-by: Florian Westphal
    Acked-by: Thomas Graf
    Signed-off-by: David S. Miller

    Joe Stringer
     

18 Jan, 2013

1 commit

  • c539f0171   netfilter: add connlabel conntrack extension ... Browse Code »

    similar to connmarks, except labels are bit-based; i.e.
    all labels may be attached to a flow at the same time.

    Up to 128 labels are supported. Supporting more labels
    is possible, but requires increasing the ct offset delta
    from u8 to u16 type due to increased extension sizes.

    Mapping of bit-identifier to label name is done in userspace.

    The extension is enabled at run-time once "-m connlabel" netfilter
    rules are added.

    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso

    Florian Westphal