[PATCH] iptables: Fix connlabel.conf install location

[PATCH] iptables: Fix connlabel.conf install location

[Phil Oester]

[-- Attachment #1: Type: text/plain, Size: 268 bytes --]

As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally
installed in /etc/xtables instead of using prefix set at configure time.  Fix
to use sysconfdir variable.

This closes bugzilla #828.

Phil

Signed-off-by: Phil Oester <kernel@linuxace.com>



[-- Attachment #2: patch-828 --]
[-- Type: text/plain, Size: 675 bytes --]

diff --git a/Makefile.am b/Makefile.am
index cd008a1..73f1352 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -25,8 +25,8 @@ tarball:
 	rm -Rf /tmp/${PACKAGE_TARNAME}-${PACKAGE_VERSION};
 
 install-data-hook:
-	@mkdir -p -m 755 $(DESTDIR)/etc/xtables/ || :
-	@test -f /etc/xtables/connlabel.conf || $(INSTALL) -m 644 etc/xtables/connlabel.conf $(DESTDIR)/etc/xtables/connlabel.conf || :
+	@mkdir -p -m 755 @sysconfdir@/xtables/ || :
+	@test -f @sysconfdir@/xtables/connlabel.conf || $(INSTALL) -m 644 etc/xtables/connlabel.conf @sysconfdir@/xtables/connlabel.conf || :
 
 config.status: extensions/GNUmakefile.in \
 	include/xtables-version.h.in include/iptables/internal.h.in

Re: [PATCH] iptables: Fix connlabel.conf install location

[Florian Westphal]

Phil Oester <kernel@linuxace.com> wrote:
> As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally
> installed in /etc/xtables instead of using prefix set at configure time.  Fix
> to use sysconfdir variable.

It was intentional.
I don't want userspace to start guessing where the config file is.

Re: [PATCH] iptables: Fix connlabel.conf install location

[Pablo Neira Ayuso]

On Mon, Jun 10, 2013 at 05:35:44AM -0400, Phil Oester wrote:
> As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally
> installed in /etc/xtables instead of using prefix set at configure time.  Fix
> to use sysconfdir variable.
> 
> This closes bugzilla #828.

Applied, thanks Phil.

Re: [PATCH] iptables: Fix connlabel.conf install location

[Pablo Neira Ayuso]

On Wed, Jun 12, 2013 at 09:51:55AM +0200, Florian Westphal wrote:
> Phil Oester <kernel@linuxace.com> wrote:
> > As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally
> > installed in /etc/xtables instead of using prefix set at configure time.  Fix
> > to use sysconfdir variable.
> 
> It was intentional.
> I don't want userspace to start guessing where the config file is.

Sorry Florian, we crossed emails while replying this.

I think this is still useful for people cross-compiling and installing
iptables in some custom location.

Regards.

Re: [PATCH] iptables: Fix connlabel.conf install location

[Pablo Neira Ayuso]

On Wed, Jun 12, 2013 at 10:50:37AM +0200, Pablo Neira Ayuso wrote:
> On Wed, Jun 12, 2013 at 09:51:55AM +0200, Florian Westphal wrote:
> > Phil Oester <kernel@linuxace.com> wrote:
> > > As reported by Danny Rawlins in bug #828, connlabel.conf is unconditionally
> > > installed in /etc/xtables instead of using prefix set at configure time.  Fix
> > > to use sysconfdir variable.
> > 
> > It was intentional.
> > I don't want userspace to start guessing where the config file is.
> 
> Sorry Florian, we crossed emails while replying this.
> 
> I think this is still useful for people cross-compiling and installing
> iptables in some custom location.

Hm, still, this may confuse people, as xt_connlabel always looks at:

#define CONNLABEL_CFG "/etc/xtables/connlabel.conf"

Re: [PATCH] iptables: Fix connlabel.conf install location

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > I think this is still useful for people cross-compiling and installing
> > iptables in some custom location.
> 
> Hm, still, this may confuse people, as xt_connlabel always looks at:
> 
> #define CONNLABEL_CFG "/etc/xtables/connlabel.conf"

Right; this is easily fixable. However, this is also
the default in libnetfilter_conntrack.  But lnf-ct wont be
able to know what configure options iptables was built with.

So libnetfilter-conntrack and conntrack-tool would
end up having to try a couple of locations to find that
config file...

Re: [PATCH] iptables: Fix connlabel.conf install location

[Pablo Neira Ayuso]

On Wed, Jun 12, 2013 at 12:06:05PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > I think this is still useful for people cross-compiling and installing
> > > iptables in some custom location.
> > 
> > Hm, still, this may confuse people, as xt_connlabel always looks at:
> > 
> > #define CONNLABEL_CFG "/etc/xtables/connlabel.conf"
> 
> Right; this is easily fixable. However, this is also
> the default in libnetfilter_conntrack.  But lnf-ct wont be
> able to know what configure options iptables was built with.

We can define the default location in libnetfilter_conntrack.h, eg.

#define NFCT_CONNLABEL_CFG "/etc/xtables/connlabel.conf"

I think connlabel is not of much use without libnetfilter_conntrack,
since it provides the translation of the connlabel mapping. So we can
conditionally compile connlabel support if libnetfilter_conntrack is
installed. We can make it a soft dependency, ie. no need for
--enable-connlabel.

Regards.

Re: [PATCH] iptables: Fix connlabel.conf install location

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Wed, Jun 12, 2013 at 12:06:05PM +0200, Florian Westphal wrote:
> > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > > I think this is still useful for people cross-compiling and installing
> > > > iptables in some custom location.
> > > 
> > > Hm, still, this may confuse people, as xt_connlabel always looks at:
> > > 
> > > #define CONNLABEL_CFG "/etc/xtables/connlabel.conf"
> > 
> > Right; this is easily fixable. However, this is also
> > the default in libnetfilter_conntrack.  But lnf-ct wont be
> > able to know what configure options iptables was built with.
> 
> We can define the default location in libnetfilter_conntrack.h, eg.
> 
> #define NFCT_CONNLABEL_CFG "/etc/xtables/connlabel.conf"

Sure, I can move the definition from conntrack/labels.c
to a public header.

> I think connlabel is not of much use without libnetfilter_conntrack,
> since it provides the translation of the connlabel mapping. So we can
> conditionally compile connlabel support if libnetfilter_conntrack is
> installed. We can make it a soft dependency, ie. no need for
> --enable-connlabel.

Hrm, the iptables connlabel extension currently parses the labels
config itself.

What we can do is to add soft dependency in iptables for
libnetfilter_conntrack, build the connlabel extension
conditionally and then remove the default file from iptables.

Is that what you have in mind?

Re: [PATCH] iptables: Fix connlabel.conf install location

[Pablo Neira Ayuso]

On Tue, Jun 25, 2013 at 09:52:00PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Wed, Jun 12, 2013 at 12:06:05PM +0200, Florian Westphal wrote:
> > > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > > > I think this is still useful for people cross-compiling and installing
> > > > > iptables in some custom location.
> > > > 
> > > > Hm, still, this may confuse people, as xt_connlabel always looks at:
> > > > 
> > > > #define CONNLABEL_CFG "/etc/xtables/connlabel.conf"
> > > 
> > > Right; this is easily fixable. However, this is also
> > > the default in libnetfilter_conntrack.  But lnf-ct wont be
> > > able to know what configure options iptables was built with.
> > 
> > We can define the default location in libnetfilter_conntrack.h, eg.
> > 
> > #define NFCT_CONNLABEL_CFG "/etc/xtables/connlabel.conf"
> 
> Sure, I can move the definition from conntrack/labels.c
> to a public header.
> 
> > I think connlabel is not of much use without libnetfilter_conntrack,
> > since it provides the translation of the connlabel mapping. So we can
> > conditionally compile connlabel support if libnetfilter_conntrack is
> > installed. We can make it a soft dependency, ie. no need for
> > --enable-connlabel.
> 
> Hrm, the iptables connlabel extension currently parses the labels
> config itself.
> 
> What we can do is to add soft dependency in iptables for
> libnetfilter_conntrack, build the connlabel extension
> conditionally and then remove the default file from iptables.
> 
> Is that what you have in mind?

Yes. BTW, you could simplify the existing iptables extension by using
the connlabel API provided by libnetfilter_conntrack.

I think you can also add --with-libnfct=PATH for people that want to
place the library somewhere in the tree, not the standard location.

Thanks.