api: add connlabel api and attribute

adds new labelmap api to create a name <-> bit mapping
from a text file (default: /etc/xtables/connlabel.conf).

nfct_labelmap_new(filename) is used to create the map,
nfct_labelmap_destroy() releases the resources allocated for the map.

Two functions are added to make map lookups:

nfct_labelmap_get_name(map, bit) returns the name of a bit,
nfct_labelmap_get_bit returns the bit associated with a name.

The connlabel attribute is represented by a nfct_bitmask object, the
nfct_bitmask api can be used to test/set/get individual bits
("labels").

The exisiting nfct_attr_get/set interfaces can be used to read or
replace the existing labels associated with a conntrack with a new set.

Signed-off-by: Florian Westphal <fw@strlen.de>

1 files changed, 23 insertions, 5 deletions

diff --git a/qa/test_api.c b/qa/test_api.c
index 911b160..399afdc 100644
--- a/qa/test_api.c
+++ b/qa/test_api.c
@@ -37,6 +37,8 @@ static void test_nfct_bitmask(void)
 	struct nfct_bitmask *a, *b;
 	unsigned short int maxb, i;
 
+	printf("== test nfct_bitmask_* API ==\n");
+
 	maxb = rand() & 0xffff;
 
 	a = nfct_bitmask_new(maxb);
@@ -77,6 +79,7 @@ static void test_nfct_bitmask(void)
 	}
 
 	nfct_bitmask_destroy(b);
+	printf("OK\n");
 }
 
 
@@ -88,6 +91,7 @@ int main(void)
 	char data[256];
 	const char *val;
 	int status;
+	struct nfct_bitmask *b;
 
 	srand(time(NULL));
 
@@ -117,8 +121,15 @@ int main(void)
 		eval_sigterm(status);
 	}
 
-	for (i=0; i<ATTR_MAX; i++)
-		nfct_set_attr(ct, i, data);
+	for (i=0; i<ATTR_MAX; i++) {
+		if (i != ATTR_CONNLABELS) {
+			nfct_set_attr(ct, i, data);
+			continue;
+		}
+		b = nfct_bitmask_new(rand() & 0xffff);
+		assert(b);
+		nfct_set_attr(ct, i, b);
+	}
 
 	printf("== test get API ==\n");
 	ret = fork();
@@ -150,11 +161,19 @@ int main(void)
 			case ATTR_HELPER_INFO:
 				nfct_set_attr_l(ct, i, data, sizeof(data));
 				break;
+			case ATTR_CONNLABELS:
+				/* already set above */
+				break;
 			default:
 				data[0] = (uint8_t) i;
 				nfct_set_attr(ct, i, data);
 			}
 			val = nfct_get_attr(ct, i);
+			switch (i) {
+			case ATTR_CONNLABELS:
+				assert((void *) val == b);
+				continue;
+			}
 
 			if (val[0] != data[0]) {
 				printf("ERROR: set/get operations don't match "
@@ -333,10 +352,9 @@ int main(void)
 	nfexp_destroy(exp);
 	nfexp_destroy(tmp_exp);
 
-	printf("== test nfct_bitmask_* API ==\n");
-	test_nfct_bitmask();
-
 	printf("OK\n");
 
+	test_nfct_bitmask();
+
 	return EXIT_SUCCESS;
 }