* [PATCH] iptables: Fix connlabel.conf install location @ 2013-06-10 9:35 Phil Oester 2013-06-12 7:51 ` Florian Westphal 2013-06-12 8:04 ` Pablo Neira Ayuso 0 siblings, 2 replies; 9+ messages in thread From: Phil Oester @ 2013-06-10 9:35 UTC (permalink / raw) To: netfilter-devel; +Cc: pablo [-- Attachment #1: Type: text/plain, Size: 268 bytes --] As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally installed in /etc/xtables instead of using prefix set at configure time. Fix to use sysconfdir variable. This closes bugzilla #828. Phil Signed-off-by: Phil Oester <kernel@linuxace.com> [-- Attachment #2: patch-828 --] [-- Type: text/plain, Size: 675 bytes --] diff --git a/Makefile.am b/Makefile.am index cd008a1..73f1352 100644 --- a/Makefile.am +++ b/Makefile.am @@ -25,8 +25,8 @@ tarball: rm -Rf /tmp/${PACKAGE_TARNAME}-${PACKAGE_VERSION}; install-data-hook: - @mkdir -p -m 755 $(DESTDIR)/etc/xtables/ || : - @test -f /etc/xtables/connlabel.conf || $(INSTALL) -m 644 etc/xtables/connlabel.conf $(DESTDIR)/etc/xtables/connlabel.conf || : + @mkdir -p -m 755 @sysconfdir@/xtables/ || : + @test -f @sysconfdir@/xtables/connlabel.conf || $(INSTALL) -m 644 etc/xtables/connlabel.conf @sysconfdir@/xtables/connlabel.conf || : config.status: extensions/GNUmakefile.in \ include/xtables-version.h.in include/iptables/internal.h.in ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH] iptables: Fix connlabel.conf install location 2013-06-10 9:35 [PATCH] iptables: Fix connlabel.conf install location Phil Oester @ 2013-06-12 7:51 ` Florian Westphal 2013-06-12 8:50 ` Pablo Neira Ayuso 2013-06-12 8:04 ` Pablo Neira Ayuso 1 sibling, 1 reply; 9+ messages in thread From: Florian Westphal @ 2013-06-12 7:51 UTC (permalink / raw) To: Phil Oester; +Cc: netfilter-devel, pablo Phil Oester <kernel@linuxace.com> wrote: > As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally > installed in /etc/xtables instead of using prefix set at configure time. Fix > to use sysconfdir variable. It was intentional. I don't want userspace to start guessing where the config file is. ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] iptables: Fix connlabel.conf install location 2013-06-12 7:51 ` Florian Westphal @ 2013-06-12 8:50 ` Pablo Neira Ayuso 2013-06-12 9:08 ` Pablo Neira Ayuso 0 siblings, 1 reply; 9+ messages in thread From: Pablo Neira Ayuso @ 2013-06-12 8:50 UTC (permalink / raw) To: Florian Westphal; +Cc: Phil Oester, netfilter-devel On Wed, Jun 12, 2013 at 09:51:55AM +0200, Florian Westphal wrote: > Phil Oester <kernel@linuxace.com> wrote: > > As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally > > installed in /etc/xtables instead of using prefix set at configure time. Fix > > to use sysconfdir variable. > > It was intentional. > I don't want userspace to start guessing where the config file is. Sorry Florian, we crossed emails while replying this. I think this is still useful for people cross-compiling and installing iptables in some custom location. Regards. ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] iptables: Fix connlabel.conf install location 2013-06-12 8:50 ` Pablo Neira Ayuso @ 2013-06-12 9:08 ` Pablo Neira Ayuso 2013-06-12 10:06 ` Florian Westphal 0 siblings, 1 reply; 9+ messages in thread From: Pablo Neira Ayuso @ 2013-06-12 9:08 UTC (permalink / raw) To: Florian Westphal; +Cc: Phil Oester, netfilter-devel On Wed, Jun 12, 2013 at 10:50:37AM +0200, Pablo Neira Ayuso wrote: > On Wed, Jun 12, 2013 at 09:51:55AM +0200, Florian Westphal wrote: > > Phil Oester <kernel@linuxace.com> wrote: > > > As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally > > > installed in /etc/xtables instead of using prefix set at configure time. Fix > > > to use sysconfdir variable. > > > > It was intentional. > > I don't want userspace to start guessing where the config file is. > > Sorry Florian, we crossed emails while replying this. > > I think this is still useful for people cross-compiling and installing > iptables in some custom location. Hm, still, this may confuse people, as xt_connlabel always looks at: #define CONNLABEL_CFG "/etc/xtables/connlabel.conf" ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] iptables: Fix connlabel.conf install location 2013-06-12 9:08 ` Pablo Neira Ayuso @ 2013-06-12 10:06 ` Florian Westphal 2013-06-25 16:01 ` Pablo Neira Ayuso 0 siblings, 1 reply; 9+ messages in thread From: Florian Westphal @ 2013-06-12 10:06 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: Florian Westphal, Phil Oester, netfilter-devel Pablo Neira Ayuso <pablo@netfilter.org> wrote: > > I think this is still useful for people cross-compiling and installing > > iptables in some custom location. > > Hm, still, this may confuse people, as xt_connlabel always looks at: > > #define CONNLABEL_CFG "/etc/xtables/connlabel.conf" Right; this is easily fixable. However, this is also the default in libnetfilter_conntrack. But lnf-ct wont be able to know what configure options iptables was built with. So libnetfilter-conntrack and conntrack-tool would end up having to try a couple of locations to find that config file... ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] iptables: Fix connlabel.conf install location 2013-06-12 10:06 ` Florian Westphal @ 2013-06-25 16:01 ` Pablo Neira Ayuso 2013-06-25 19:52 ` Florian Westphal 0 siblings, 1 reply; 9+ messages in thread From: Pablo Neira Ayuso @ 2013-06-25 16:01 UTC (permalink / raw) To: Florian Westphal; +Cc: Phil Oester, netfilter-devel On Wed, Jun 12, 2013 at 12:06:05PM +0200, Florian Westphal wrote: > Pablo Neira Ayuso <pablo@netfilter.org> wrote: > > > I think this is still useful for people cross-compiling and installing > > > iptables in some custom location. > > > > Hm, still, this may confuse people, as xt_connlabel always looks at: > > > > #define CONNLABEL_CFG "/etc/xtables/connlabel.conf" > > Right; this is easily fixable. However, this is also > the default in libnetfilter_conntrack. But lnf-ct wont be > able to know what configure options iptables was built with. We can define the default location in libnetfilter_conntrack.h, eg. #define NFCT_CONNLABEL_CFG "/etc/xtables/connlabel.conf" I think connlabel is not of much use without libnetfilter_conntrack, since it provides the translation of the connlabel mapping. So we can conditionally compile connlabel support if libnetfilter_conntrack is installed. We can make it a soft dependency, ie. no need for --enable-connlabel. Regards. ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] iptables: Fix connlabel.conf install location 2013-06-25 16:01 ` Pablo Neira Ayuso @ 2013-06-25 19:52 ` Florian Westphal 2013-07-03 0:13 ` Pablo Neira Ayuso 0 siblings, 1 reply; 9+ messages in thread From: Florian Westphal @ 2013-06-25 19:52 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: Florian Westphal, Phil Oester, netfilter-devel Pablo Neira Ayuso <pablo@netfilter.org> wrote: > On Wed, Jun 12, 2013 at 12:06:05PM +0200, Florian Westphal wrote: > > Pablo Neira Ayuso <pablo@netfilter.org> wrote: > > > > I think this is still useful for people cross-compiling and installing > > > > iptables in some custom location. > > > > > > Hm, still, this may confuse people, as xt_connlabel always looks at: > > > > > > #define CONNLABEL_CFG "/etc/xtables/connlabel.conf" > > > > Right; this is easily fixable. However, this is also > > the default in libnetfilter_conntrack. But lnf-ct wont be > > able to know what configure options iptables was built with. > > We can define the default location in libnetfilter_conntrack.h, eg. > > #define NFCT_CONNLABEL_CFG "/etc/xtables/connlabel.conf" Sure, I can move the definition from conntrack/labels.c to a public header. > I think connlabel is not of much use without libnetfilter_conntrack, > since it provides the translation of the connlabel mapping. So we can > conditionally compile connlabel support if libnetfilter_conntrack is > installed. We can make it a soft dependency, ie. no need for > --enable-connlabel. Hrm, the iptables connlabel extension currently parses the labels config itself. What we can do is to add soft dependency in iptables for libnetfilter_conntrack, build the connlabel extension conditionally and then remove the default file from iptables. Is that what you have in mind? ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] iptables: Fix connlabel.conf install location 2013-06-25 19:52 ` Florian Westphal @ 2013-07-03 0:13 ` Pablo Neira Ayuso 0 siblings, 0 replies; 9+ messages in thread From: Pablo Neira Ayuso @ 2013-07-03 0:13 UTC (permalink / raw) To: Florian Westphal; +Cc: Phil Oester, netfilter-devel On Tue, Jun 25, 2013 at 09:52:00PM +0200, Florian Westphal wrote: > Pablo Neira Ayuso <pablo@netfilter.org> wrote: > > On Wed, Jun 12, 2013 at 12:06:05PM +0200, Florian Westphal wrote: > > > Pablo Neira Ayuso <pablo@netfilter.org> wrote: > > > > > I think this is still useful for people cross-compiling and installing > > > > > iptables in some custom location. > > > > > > > > Hm, still, this may confuse people, as xt_connlabel always looks at: > > > > > > > > #define CONNLABEL_CFG "/etc/xtables/connlabel.conf" > > > > > > Right; this is easily fixable. However, this is also > > > the default in libnetfilter_conntrack. But lnf-ct wont be > > > able to know what configure options iptables was built with. > > > > We can define the default location in libnetfilter_conntrack.h, eg. > > > > #define NFCT_CONNLABEL_CFG "/etc/xtables/connlabel.conf" > > Sure, I can move the definition from conntrack/labels.c > to a public header. > > > I think connlabel is not of much use without libnetfilter_conntrack, > > since it provides the translation of the connlabel mapping. So we can > > conditionally compile connlabel support if libnetfilter_conntrack is > > installed. We can make it a soft dependency, ie. no need for > > --enable-connlabel. > > Hrm, the iptables connlabel extension currently parses the labels > config itself. > > What we can do is to add soft dependency in iptables for > libnetfilter_conntrack, build the connlabel extension > conditionally and then remove the default file from iptables. > > Is that what you have in mind? Yes. BTW, you could simplify the existing iptables extension by using the connlabel API provided by libnetfilter_conntrack. I think you can also add --with-libnfct=PATH for people that want to place the library somewhere in the tree, not the standard location. Thanks. ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] iptables: Fix connlabel.conf install location 2013-06-10 9:35 [PATCH] iptables: Fix connlabel.conf install location Phil Oester 2013-06-12 7:51 ` Florian Westphal @ 2013-06-12 8:04 ` Pablo Neira Ayuso 1 sibling, 0 replies; 9+ messages in thread From: Pablo Neira Ayuso @ 2013-06-12 8:04 UTC (permalink / raw) To: Phil Oester; +Cc: netfilter-devel On Mon, Jun 10, 2013 at 05:35:44AM -0400, Phil Oester wrote: > As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally > installed in /etc/xtables instead of using prefix set at configure time. Fix > to use sysconfdir variable. > > This closes bugzilla #828. Applied, thanks Phil. ^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2013-07-03 0:13 UTC | newest] Thread overview: 9+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2013-06-10 9:35 [PATCH] iptables: Fix connlabel.conf install location Phil Oester 2013-06-12 7:51 ` Florian Westphal 2013-06-12 8:50 ` Pablo Neira Ayuso 2013-06-12 9:08 ` Pablo Neira Ayuso 2013-06-12 10:06 ` Florian Westphal 2013-06-25 16:01 ` Pablo Neira Ayuso 2013-06-25 19:52 ` Florian Westphal 2013-07-03 0:13 ` Pablo Neira Ayuso 2013-06-12 8:04 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).