[iptables PATCH] configure: disable connlabel for static builds

[iptables PATCH] configure: disable connlabel for static builds

[Gustavo Zacarias]

Disable connlabel for purely static builds since it pulls in libdl which
isn't available in such cases causing build breakage.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
---
 configure.ac | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/configure.ac b/configure.ac
index 2521ccc..0f92c48 100644
--- a/configure.ac
+++ b/configure.ac
@@ -88,8 +88,12 @@ if test "$ac_cv_header_linux_ip_vs_h" != "yes"; then
 	blacklist_modules="$blacklist_modules ipvs";
 fi;
 
+if test "$enable_shared" = "yes"; then
 PKG_CHECK_MODULES([libnetfilter_conntrack], [libnetfilter_conntrack >= 1.0.4],
 	[nfconntrack=1], [nfconntrack=0])
+else
+	nfconntrack=0
+fi;
 AM_CONDITIONAL([HAVE_LIBNETFILTER_CONNTRACK], [test "$nfconntrack" = 1])
 
 if test "$nfconntrack" -ne 1; then
-- 
2.0.5

Re: [iptables PATCH] configure: disable connlabel for static builds

[Florian Westphal]

Gustavo Zacarias <gustavo@zacarias.com.ar> wrote:
> Disable connlabel for purely static builds since it pulls in libdl which
> isn't available in such cases causing build breakage.

What do you mean by 'purely static builds'?
In any case, current iptables master

./configure --disable-shared --enable-static && make

fails to build with your patch applied since configure thinks
that neither libmnl nor libfntnl are present.

I also don't understand why connlabel should not be built with above
configure options, care to elaborate?

Re: [iptables PATCH] configure: disable connlabel for static builds

[Gustavo Zacarias]

On 01/13/2015 04:32 PM, Florian Westphal wrote:

> Gustavo Zacarias <gustavo@zacarias.com.ar> wrote:
>> Disable connlabel for purely static builds since it pulls in libdl which
>> isn't available in such cases causing build breakage.
> 
> What do you mean by 'purely static builds'?
> In any case, current iptables master
> 
> ./configure --disable-shared --enable-static && make
> 
> fails to build with your patch applied since configure thinks
> that neither libmnl nor libfntnl are present.
> 
> I also don't understand why connlabel should not be built with above
> configure options, care to elaborate?

See
http://autobuild.buildroot.net/results/b45/b45df862a5c7e0a45017d6be33a818c98489b663/
(build-end.log)

That's the precise build failure which is triggered when
libnetfilter_conntrack is around.
When it's not around (nfconntrack=0, from PKG_CHECK_MODULES) it won't
try to build it and the result is a proper purely-static build.
Hence i set it that way in the patch when the user explicitly says
--disable-shared.
Purely-static is a toolchain where there is no dlfcn.h and libdl, not
something you would see from (e)glibc but normal for uClibc.

I haven't tried on iptables master which adds nft functionality yet, but
this fixes it for 1.4.21.

Regards.

Re: [iptables PATCH] configure: disable connlabel for static builds

[Jan Engelhardt]

On Tuesday 2015-01-13 20:40, Gustavo Zacarias wrote:
>> 
>> ./configure --disable-shared --enable-static && make
>> 
>See
>http://autobuild.buildroot.net/results/b45/b45df862a5c7e0a45017d6be33a818c98489b663/
>(build-end.log)
>
>That's the precise build failure which is triggered when
>libnetfilter_conntrack is around.

The -ldl which appears in the command line, it suggests that it stems
from libxtables.la. (Unless there is one in your libnetfilter_conntrack.la.)

Re: [iptables PATCH] configure: disable connlabel for static builds

[Gustavo Zacarias]

On 01/13/2015 09:32 PM, Jan Engelhardt wrote:

>> That's the precise build failure which is triggered when
>> libnetfilter_conntrack is around.
> 
> The -ldl which appears in the command line, it suggests that it stems
> from libxtables.la. (Unless there is one in your libnetfilter_conntrack.la.)

It's coming from libnetfilter_conntrack.la from src/Makefile.am (hardcoded).
Not only that, you've also got -ldl in Libs.private in xtables.pc.in in
an unconditional way (iptables) but that's not the culprit at this point.
I'll send a revised patch against libnetfilter_conntrack unless there's
a good reason for getting it hardcoded there (other than static building
since killing it makes iptables build fine).
Florian: regarding iptables master it won't build static with nft
support enabled, i'll look into it, but at least it's an option that can
be easily disabled for the build, so no quick patches required.
Regards.