[ulogd2] lower netfilter library requirements

[ulogd2] lower netfilter library requirements

[Victor Julien]

Currently ulogd2 requires pretty much the latest versions of the
netfilter libraries. This seems to be unnecessary.

[Ulogd2 PATCH 1/3] Remove configure check for libmnl, it is not used

[Victor Julien]

If libmnl is missing configure fails. However, the lib is not used nor
linked to.

---
 configure.ac |    1 -
 1 file changed, 1 deletion(-)

diff --git a/configure.ac b/configure.ac
index c94704b..a439bee 100644
--- a/configure.ac
+++ b/configure.ac
@@ -49,7 +49,6 @@ AC_SUBST([regular_CFLAGS])
 
 dnl Check for the right nfnetlink version
 PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 1.0.1])
-PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])
 AC_ARG_ENABLE(nflog,
        AS_HELP_STRING([--enable-nflog], [Enable nflog module [default=yes]]),,[enable_nflog=yes])
 AS_IF([test "x$enable_nflog" = "xyes"], [
-- 
1.7.10.4

Re: [Ulogd2 PATCH 1/3] Remove configure check for libmnl, it is not used

[Pablo Neira Ayuso]

On Fri, Apr 05, 2013 at 04:33:55PM +0200, Victor Julien wrote:
> If libmnl is missing configure fails. However, the lib is not used nor
> linked to.
> 
> ---
>  configure.ac |    1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/configure.ac b/configure.ac
> index c94704b..a439bee 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -49,7 +49,6 @@ AC_SUBST([regular_CFLAGS])
>  
>  dnl Check for the right nfnetlink version
>  PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 1.0.1])
> -PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])

input/sum/ulogd_inpflow_NFACCT.c

needs this.

Re: [Ulogd2 PATCH 1/3] Remove configure check for libmnl, it is not used

[Victor Julien]

On 04/05/2013 05:34 PM, Pablo Neira Ayuso wrote:
> On Fri, Apr 05, 2013 at 04:33:55PM +0200, Victor Julien wrote:
>> If libmnl is missing configure fails. However, the lib is not used nor
>> linked to.
>>
>> ---
>>  configure.ac |    1 -
>>  1 file changed, 1 deletion(-)
>>
>> diff --git a/configure.ac b/configure.ac
>> index c94704b..a439bee 100644
>> --- a/configure.ac
>> +++ b/configure.ac
>> @@ -49,7 +49,6 @@ AC_SUBST([regular_CFLAGS])
>>  
>>  dnl Check for the right nfnetlink version
>>  PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 1.0.1])
>> -PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])
> 
> input/sum/ulogd_inpflow_NFACCT.c
> 
> needs this.

Shouldn't it be a conditional check then? Only if nfacct is enabled?

I'm testing with only nflog support and it builds and runs fine with my
patch.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------

Re: [Ulogd2 PATCH 1/3] Remove configure check for libmnl, it is not used

[Pablo Neira Ayuso]

On Fri, Apr 05, 2013 at 05:47:13PM +0200, Victor Julien wrote:
> On 04/05/2013 05:34 PM, Pablo Neira Ayuso wrote:
> > On Fri, Apr 05, 2013 at 04:33:55PM +0200, Victor Julien wrote:
> >> If libmnl is missing configure fails. However, the lib is not used nor
> >> linked to.
> >>
> >> ---
> >>  configure.ac |    1 -
> >>  1 file changed, 1 deletion(-)
> >>
> >> diff --git a/configure.ac b/configure.ac
> >> index c94704b..a439bee 100644
> >> --- a/configure.ac
> >> +++ b/configure.ac
> >> @@ -49,7 +49,6 @@ AC_SUBST([regular_CFLAGS])
> >>  
> >>  dnl Check for the right nfnetlink version
> >>  PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 1.0.1])
> >> -PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])
> > 
> > input/sum/ulogd_inpflow_NFACCT.c
> > 
> > needs this.
> 
> Shouldn't it be a conditional check then? Only if nfacct is enabled?

That's fine with me.

[Ulogd2 PATCH 2/3] Lower libnfnetlink requirement to 1.0.0

[Victor Julien]

Build and run tested against 1.0.0, worked fine for me.

---
 configure.ac |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure.ac b/configure.ac
index a439bee..5755cf5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -48,7 +48,7 @@ regular_CFLAGS="-Wall -Wextra -Wno-unused-parameter"
 AC_SUBST([regular_CFLAGS])
 
 dnl Check for the right nfnetlink version
-PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 1.0.1])
+PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 1.0.0])
 AC_ARG_ENABLE(nflog,
        AS_HELP_STRING([--enable-nflog], [Enable nflog module [default=yes]]),,[enable_nflog=yes])
 AS_IF([test "x$enable_nflog" = "xyes"], [
-- 
1.7.10.4

Re: [Ulogd2 PATCH 2/3] Lower libnfnetlink requirement to 1.0.0

[Pablo Neira Ayuso]

On Fri, Apr 05, 2013 at 04:33:56PM +0200, Victor Julien wrote:
> Build and run tested against 1.0.0, worked fine for me.
> 
> ---
>  configure.ac |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/configure.ac b/configure.ac
> index a439bee..5755cf5 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -48,7 +48,7 @@ regular_CFLAGS="-Wall -Wextra -Wno-unused-parameter"
>  AC_SUBST([regular_CFLAGS])
>  
>  dnl Check for the right nfnetlink version
> -PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 1.0.1])
> +PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 1.0.0])

Same thing here. There was also a reason to bump the version
dependency.

There's a fix in libnfnetlink in the nlif interface.

commit 8b15e485c0d5f4a1e56b2148a34995ed1fa9e95b
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Mon Aug 13 19:49:58 2012 +0200

    iftable: fix incomplete list of interfaces via nlif_query

In systems with lots of NICs, nlif_query may fail without that patch
in libnfnetlink.

Please, don't downgrade the dependencies.

Re: [Ulogd2 PATCH 2/3] Lower libnfnetlink requirement to 1.0.0

[Victor Julien]

On 04/05/2013 05:39 PM, Pablo Neira Ayuso wrote:
> On Fri, Apr 05, 2013 at 04:33:56PM +0200, Victor Julien wrote:
>> Build and run tested against 1.0.0, worked fine for me.
>>
>> ---
>>  configure.ac |    2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/configure.ac b/configure.ac
>> index a439bee..5755cf5 100644
>> --- a/configure.ac
>> +++ b/configure.ac
>> @@ -48,7 +48,7 @@ regular_CFLAGS="-Wall -Wextra -Wno-unused-parameter"
>>  AC_SUBST([regular_CFLAGS])
>>  
>>  dnl Check for the right nfnetlink version
>> -PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 1.0.1])
>> +PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 1.0.0])
> 
> Same thing here. There was also a reason to bump the version
> dependency.
> 
> There's a fix in libnfnetlink in the nlif interface.
> 
> commit 8b15e485c0d5f4a1e56b2148a34995ed1fa9e95b
> Author: Pablo Neira Ayuso <pablo@netfilter.org>
> Date:   Mon Aug 13 19:49:58 2012 +0200
> 
>     iftable: fix incomplete list of interfaces via nlif_query
> 
> In systems with lots of NICs, nlif_query may fail without that patch
> in libnfnetlink.
> 
> Please, don't downgrade the dependencies.

Okay, got it. Would have been nice to be able to work with the versions
installed by recent distro's though.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------

Re: [Ulogd2 PATCH 2/3] Lower libnfnetlink requirement to 1.0.0

[Pablo Neira Ayuso]

On Fri, Apr 05, 2013 at 06:08:05PM +0200, Victor Julien wrote:
> On 04/05/2013 05:39 PM, Pablo Neira Ayuso wrote:
> > On Fri, Apr 05, 2013 at 04:33:56PM +0200, Victor Julien wrote:
> >> Build and run tested against 1.0.0, worked fine for me.
> >>
> >> ---
> >>  configure.ac |    2 +-
> >>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>
> >> diff --git a/configure.ac b/configure.ac
> >> index a439bee..5755cf5 100644
> >> --- a/configure.ac
> >> +++ b/configure.ac
> >> @@ -48,7 +48,7 @@ regular_CFLAGS="-Wall -Wextra -Wno-unused-parameter"
> >>  AC_SUBST([regular_CFLAGS])
> >>  
> >>  dnl Check for the right nfnetlink version
> >> -PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 1.0.1])
> >> +PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 1.0.0])
> > 
> > Same thing here. There was also a reason to bump the version
> > dependency.
> > 
> > There's a fix in libnfnetlink in the nlif interface.
> > 
> > commit 8b15e485c0d5f4a1e56b2148a34995ed1fa9e95b
> > Author: Pablo Neira Ayuso <pablo@netfilter.org>
> > Date:   Mon Aug 13 19:49:58 2012 +0200
> > 
> >     iftable: fix incomplete list of interfaces via nlif_query
> > 
> > In systems with lots of NICs, nlif_query may fail without that patch
> > in libnfnetlink.
> > 
> > Please, don't downgrade the dependencies.
> 
> Okay, got it. Would have been nice to be able to work with the versions
> installed by recent distro's though.

Pull your vendor to upgrade, not me :-).

[Ulogd2 PATCH 3/3] Lower libnetfilter_conntrack requirement to 0.9.1

[Victor Julien]

Build tested, no warnings.

---
 configure.ac |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure.ac b/configure.ac
index 5755cf5..b17ecb6 100644
--- a/configure.ac
+++ b/configure.ac
@@ -59,7 +59,7 @@ AM_CONDITIONAL([BUILD_NFLOG], [test "x$enable_nflog" = "xyes"])
 AC_ARG_ENABLE(nfct,
        AS_HELP_STRING([--enable-nfct], [Enable nfct module [default=yes]]),,[enable_nfct=yes])
 AS_IF([test "x$enable_nfct" = "xyes"], [
-    PKG_CHECK_MODULES([LIBNETFILTER_CONNTRACK], [libnetfilter_conntrack >= 1.0.2])
+    PKG_CHECK_MODULES([LIBNETFILTER_CONNTRACK], [libnetfilter_conntrack >= 0.9.1])
     AC_DEFINE([BUILD_NFCT], [1], [Building nfct module])
 ])
 AM_CONDITIONAL([BUILD_NFCT], [test "x$enable_nfct" = "xyes"])
-- 
1.7.10.4

Re: [Ulogd2 PATCH 3/3] Lower libnetfilter_conntrack requirement to 0.9.1

[Pablo Neira Ayuso]

On Fri, Apr 05, 2013 at 04:33:57PM +0200, Victor Julien wrote:
> Build tested, no warnings.
> 
> ---
>  configure.ac |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/configure.ac b/configure.ac
> index 5755cf5..b17ecb6 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -59,7 +59,7 @@ AM_CONDITIONAL([BUILD_NFLOG], [test "x$enable_nflog" = "xyes"])
>  AC_ARG_ENABLE(nfct,
>         AS_HELP_STRING([--enable-nfct], [Enable nfct module [default=yes]]),,[enable_nfct=yes])
>  AS_IF([test "x$enable_nfct" = "xyes"], [
> -    PKG_CHECK_MODULES([LIBNETFILTER_CONNTRACK], [libnetfilter_conntrack >= 1.0.2])
> +    PKG_CHECK_MODULES([LIBNETFILTER_CONNTRACK], [libnetfilter_conntrack >= 0.9.1])

There was a fix for Eric Leblond's kernel-space ct filtering, if you
downgrade this, people may come back and report that they are hitting
old bugs.